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Abstract 

We present a formal system, E, which provides a faithful model of the 
proofs in Euclid's Elements, including the use of diagrammatic reasoning. 
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1 Introduction 

For more than two millennia, Euclid's Elements was viewed by mathematicians 
and philosophers alike as a paradigm of rigorous argumentation. But the work 
lost some of its lofty status in the nineteenth century, amidst concerns related 
to the use of diagrams in its proofs. Recognizing the correctness of Euclid's 
inferences was thought to require an "intuitive" use of these diagrams, whereas, 
in a proper mathematical argument, every assumption should be spelled out 
explicitly. Moreover, there is the question as to how an argument that relies 
on a single diagram can serve to justify a general mathematical claim: any 
triangle one draws will, for example, be either acute, right, or obtuse, leaving 
the same intuitive faculty burdened with the task of ensuring that the argument 
is equally valid for all triangles Such a reliance on intuition was therefore felt 
to fall short of delivering mathematical certainty. 

Without denying the importance of the Elements, by the end of the nine- 
teenth century the common attitude among mathematicians and philosophers 
was that the appropriate logical analysis of geometric inference should be cast 
in terms of axioms and rules of inference. This view was neatly summed up by 
Leibniz more than two centuries earlier: 

... it is not the figures which furnish the proof with geometers, 
though the style of the exposition may make you think so. The 
force of the demonstration is independent of the figure drawn, which 
is drawn only to facilitate the knowledge of our meaning, and to fix 

^The question was raised by early modern philosophers from Berkeley [4l Section 16] to 
Kant m A716/B744]. See [l7][2Ql|4Dl[52][53l|5i] for discussions of the philosophical concerns. 
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the attention; it is the universal propositions, i.e. the definitions, 
axioms, and theorems aheady demonstrated, which make the rea- 
soning, and which would sustain it though the figure were not there. 
m P- 403] 

This attitude gave rise to informal axiomatizations by Pasch [IB] , Peano [17] , and 
Hilbert |22j in the late nineteenth century, and Tarski's formal axiomatization 
[57] in the twentieth. 

Proofs in these axiomatic systems, however, do not look much like proofs in 
the Elements. Moreover, the modern attitude belies the fact that for over two 
thousand years Euclidean geometry was a remarkably stable practice. On the 
consensus view, the logical gaps in Euclid's presentation should have resulted 
in vagueness or ambiguity as to the admissible rules of inference. But, in prac- 
tice, they did not; mathematicians through the ages and across cultures could 
read, write, and communicate Euclidean proofs without getting bogged down 
in questions of correctness. So, even if one accepts the consensus view, it is still 
reasonable to seek some sort of explanation of the success of the practice. 

Our goal here is to provide a detailed analysis of the methods of inference 
that are employed in the Elements. We show, in particular, that the use of dia- 
grams in a Euclidean proof is not soft and fuzzy, but controlled and systematic, 
and governed by a discernible logic. This provides a sense in which Euclid's 
methods are more rigorous than the modern attitude suggests. 

Our study draws on an analysis of Euclidean reasoning due to Ken Man- 
ders [35], who distinguished between two types of assertions that are made of 
the geometric configurations arising in Euclid's proofs. The first type of as- 
sertion describes general topological properties of the configuration, such as 
incidence of points and lines, intersections, the relative position of points along 
a line, or inclusions of angles. Manders called these co-exact attributions, since 
they are stable under perturbations of the diagram; below, we use the term 
"diagrammatic assertions" instead. The second type includes things like con- 
gruence of segments and angles, and comparisons between linear or angular 
magnitudes. Manders called these exact attributions, because they are not sta- 
ble under small variations, and hence may not be adequately represented in 
a figure that is roughly drawn. Below, we use the term "metric assertions" 
instead. Inspecting the proofs in the Elements, Manders observed that the dia- 
grams are only used to record and infer co-exact claims; exact claims are always 
made explicit in the text. For example, one might infer from the diagram that 
a point lies between two others on a line, but one would never infer the congru- 
ence of two segments without justifying the conclusion in the text. Similarly, 
one cannot generally infer, from inspecting two angles in a diagram, that one is 
larger than the other; but one can draw this conclusion if the diagram "shows" 
that the first is properly contained in the second. 

Below, we present a formal axiomatic system, E, which spells out pre- 
cisely what inferences can be "read off" from the diagram. Our work builds 
on Mumma's PhD thesis [321 1 which developed such a diagram-based system, 
which he called Eu. In Mumma's system, diagrams are bona-fide objects, which 
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are introduced in the course of a proof and serve to license inferences. Mumma's 
diagrams are represented by geometric objects on a finite coordinate grid. How- 
ever, Mumma introduced a notion of "equivalent diagrams" to explain how one 
can apply a theorem derived from a different diagram that nonetheless bears 
the same diagrammatic information. Introducing an equivalence relation in this 
way suggests that, from a logical perspective, what is really relevant to the 
proof is the equivalence class of all the diagrams that bear the same informa- 
tion. We have thus chosen a more abstract route, whereby we identify the 
"diagram" with the co-exact information that the physical drawing is supposed 
to bear. Nathaniel Miller's PhD dissertation [3S] provides another formal sys- 
tem for diagrammatic reasoning, along these lines, employing "diagrams" that 
are graph-theoretic objects subject to certain combinatorial constraints. 

Both Mumma and Miller address the issue of how reasoning based on a 
particular diagram can secure general conclusions, though they do so in different 
ways. In Miller's system, when a construction can result in topologically distinct 
diagrammatic configurations, one is required to consider all the cases, and show 
that the desired conclusion is warranted in each. In contrast, Mumma stipulated 
general rules, based on the particulars of the construction, that must be followed 
to ensure that the facts read off from the particular diagram are generally valid. 
Our formulation of E derives from this latter approach, which, we argue below, 
is more faithful to Euclidean practice. 

Moreover, we show that our proof system is sound and complete for a 
standard semantics of "ruler-and-compass constructions," expressed in mod- 
ern terms. Thus, our presentation of E is accompanied by both philosophical 
and mathematical claims: on the one hand, we claim that our formal system ac- 
curately models many of the key methodological features that are characteristic 
of the proofs found in books I through IV of the Elements; and, on the other 
hand, we claim that it is sound and complete for the appropriate semantics. 

The outline of this paper is as follows. In Section[2l we begin with an informal 
discussion of proofs in the Elements, calling attention to the particular features 
that we are trying to model. In Section [31 we describe the formal system, E, 
and specify its language and rules of inference. In SectionlU we justify the claim 
that our system provides a faithful model of the proofs in the Elements, calling 
attention to points of departure as well as points of agreement. In Section [5l we 
show that our formal system is sound and complete with respect to ruler-and- 
compass constructions. In Section [6l we discuss ways in which contemporary 
methods of automated reasoning can be used to implement a proof checker 
that can mechanically verify proofs in our system. Finally, in Section [71 we 
summarize our findings, and indicate some questions and issues that are not 
addressed in our work. 

2 Characterizing the Elements 

In this section, we clarify the claim that our formal system is more faithful to 
the Elements than other axiomatic systems, by describing the features of the 
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Elements that we take to be salient. 



2.1 Examples of proofs in the Elements 

To support our discussion, it will be helpful to have two examples of Euclidean 
proofs at hand. 

Proposition 1. 10. To bisect a given finite straight line. 



Proof. Let ab be the given finite straight line. 
It is required to bisect the finite straight line ab. 

Let the equilateral triangle abc be constructed on it [LI], and let the angle acb 

be bisected by the straight line cd. [1.9] 

I say that the straight line ab is bisected at the point d. 

For, since ac is equal to c6, and cd is common, the two sides ac, cd are equal 
the two sides be, cd respectively; and the angle acd is equal to the angle bed; 
therefore the base ad is equal to the base bd. [1.4] 
Therefore the given finite straight line ab has been bisected at d. 



This is Proposition 10 of Book I of the Elements. All our references to the 
Elements refer to the Heath translation [16] . though we have replaced upper- 
case labels for points by lower-case labels in the proof, to match the description 
of our formal system, E. 

As is typical in the Elements, the initial statement of the proposition is 
stated in something approximating natural language. A more mathematical 
statement of the proposition is then given in the opening lines of the proof. The 
annotations in brackets refer back to prior propositions, so, for example, the 
third sentence of the proof refers to Propositions 1 and 9 of Book I. Notice that 
what it means for a point d to "bisect" the finite segment ab can be analyzed 
into topological and metric components: we expect d to lie on the same line as 
a and b, and to lie between a and b on that line; and we expect that the length 
of the segment from a to 6 is equal to the length of the segment from 6 to d. 
Only the last part of the claim is made explicit in the text; the other two facts 
are implicit in the diagram. 

In his fifth century commentary on the first book of the Elements, Proclus 
divided Euclid's propositions into two groups: "problems," which assert that 
a construction can be carried out, or a diagram expanded, in a certain way; 
and "theorems," which assert that certain properties are essential to a given 
diagram (see [36l pp. 63-67], or [16, vol. I, pp. 124-129]). Euclid himself marks 
the distinction by ending proofs of problems with the phrase "that which it 
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was required to do" (abbreviated by "Q.E.F.," for "quod erat faciendum," by 
Heath); and ending proofs of theorems with the phrase "that which it was 
required to prove" (abbreviated by "Q.E.D.," for "quod erat demonstratum"). 
Proposition 1. 10 calls for the construction of a point bisecting the line, and so 
the proof ends with "Q.E.F." 

Proposition 1.16. In any triangle, if one of the sides he produced, then the 
exterior angle is greater than either of the interior and opposite angles. 

a f 



Proof. Let aba be a triangle, and let one side of it be be produced to d. 

I say that the exterior angle acd is greater than either of the interior and opposite 

angles aba, baa. 

Let ac be bisected at e [LIO], 

and let be be joined and produced in a straight line to /; 

Let ef be made equal to be [1.3], 

let fa be joined, [Post.l] 

and let ac be drawn through to g. [Post. 2] 

Then, since ae is equal to ec, and be to ef, the two sides ae, eb are equal the 
two sides ce, ef respectively; and the angle aeb is equal to the angle fee, for 
they are vertical angles. [L15] 

Therefore the base ab is equal to the base fc, the triangle ahe is equal to the 

triangle cfe, and the remaining angles equal the remaining angles respectively, 

namely those which the equal sides subtend: [L4] 

therefore the angle bae is equal to the angle ecf. 

But the angle ecd is greater than the angle ecf; [C.N. 5] 

therefore the angle acd is greater than the angle bae. 

Similarly also, if be be bisected, the angle beg, that is, the angle acd [1.15], can 
be proved greater than the angle abc as well. 
Therefore etc. 

Q.E.D. □ 

Here, the abbreviation "Post." in brackets refers to Euclid's postulates, while the 
abbreviation "C.N." refers to the common notions. Notice that the proposition 
assumes that the triangle is nondegenerate. Later on, Euclid will prove the 
stronger Proposition 1.32, which shows the the exterior angle acd is exactly equal 
to the sum of the interior and opposite angles cba and bac. But to do that, he 
has to develop properties of parallel lines, for which the current proposition is 
needed. 

In both cases, after stating the theorem, the proofs begin with a construction 
phrase (kataskeue) , in which new objects are introduced into the diagram. This 
is followed by the deduction phase {apodeixis), where the desired conclusions 
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are drawn. The demonstration phase is, for the most part, devoted towards reg- 
istering metric information, that is, equahties and inequahties between various 
magnitudes. But some of the inferences depend on the diagrammatic config- 
uration. For example, seeing that angles aeb and fee are equal in the second 
proof requires checking the diagram to see that they are vertical angles. Simi- 
larly, seeing that eed is greater than eef is warranted by common notion 5, "the 
whole is greater than the part," requires checking the diagram to confirm that 
eef is indeed contained in eed. 

2.2 The use of diagrams 

The most salient feature of the Elements is the fact that diagrams play a role 
in the arguments. But what, exactly, docs this mean? 

Our first observation is that whatever role the diagram plays, it is inessential 
to the communication of the proof. In fact, data on the early history of the text 
of the Elements is meager, and there is no chain linking our contemporary 
diagrams with the ones that Euclid actually drew; it is likely that, over the 
years, diagrams were often reconstructed from the text (see Netz [H]). But 
a simple experiment offers more direct support for our claim. If you cover up 
the diagrams and reread the proofs in the last section, you will find that it is 
not difficult to reconstruct the diagram. Occasionally, important details are 
only represented in the diagram and not the text; for example, in the proof 
of Proposition 1. 10, the text does not indicate that d is supposed to mark the 
intersection of the angle bisector and the opposite side of the triangle. But there 
is no reason why it couldn't; for example, we could replace the second sentence 
with the following one: 

Let the equilateral triangle abe be constructed on it, let the angle 
aeb be bisected by the straight line L, and let d be the intersection 
of L and ab. 

The fact that minor changes like this render it straightforward to construct an 
adequate diagram suggests that the relevant information can easily be borne by 
the text. 

But, to continue the experiment, try reading these proofs, or any of Euclid's 
proofs, without the diagram, and without drawing a diagram. You will likely 
finding yourself trying to imagine the diagram, to "see" that the ensuing dia- 
grammatic claims are justified. So even if, in some sense, the text-based version 
of the proof is self-contained, there is something about the proof, and the tasks 
we need to perform to understand the proof, that makes it "diagrammatic." 

To make the point clear, consider the following example: 

Let L be a line. Let a and b be points on L, and let c be between a 
and b. Let d be between a and c, and let e be between c and b. Is d 
necessarily between a and e? 

Once again, it is hard to make sense of the question without drawing a diagram 
or picturing the situation in your mind's eye; but doing so should easily convince 
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you that the answer is "yes." With the diagram in place, there is nothing more 
that needs to be said. The inference is immediate, whether or not we are able 
to cite the axioms governing the betweenness predicate that would be used to 
justify the assertion in an axiomatic proof system. 

A central goal of this paper is to analyze and describe these fundamental 
diagrammatic inferences. In doing so, we do not attempt to explain why it is 
easier for us to verify these inferences with a physical diagram before us, nor do 
we attempt to explain the social or historical factors that made such inferences 
basic to the Elements. In other words, in analyzing the Elements, we adopt 
a methodological stance which focuses on the logical structure of the proofs 
while screening off other important issues. We return to a discussion of this in 
Section [Ml 

2.3 The problem of ensuring generality 

On further reflection, the notion of a diagrammatic inference becomes puzzling. 
Consider the following example: 

Let a and b be distinct points, and let L be the line through a and 
b. Let c and d be points on opposite sides of L, and let M be the 
line through c and d. Let e be the intersection of L and M. Is e 
necessarily between c and d? 

Drawing a diagram, or picturing the situation in your mind's eye, should con- 
vince you that the answer is "yes," based on an "intuitive" understanding of 
the concepts involved: 





c 






e 


L 


a 




b 


M 


d 





In fact, a diagrammatic inference was even implicit in the instruction "let e 
be the intersection of L and M," namely, in seeing that L and M necessarily 
intersect. 

So far, all is well. But now suppose we replace the last question in the 
example with the following: 

Is e necessarily between a and 5? 

Consulting our diagram, we should perhaps conclude that the answer is "yes." 
But that is patently absurd; we could easily have drawn the diagram to put 
e anywhere along L. Neither Euclid nor any competent student of Euclidean 
geometry would draw the invalid inference. Thus any respectable notion of 
"diagrammatic inference" has to sanction the first inference in our example, 
but bar the second. 
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There are two morals to be extracted from this httle exercise. The first is 
that, however the diagram functions in a EucHdean proof, using the diagram is 
not simply a matter of reading off features found in the physical instantiation. 
Any way of drawing the diagram will give e a position relative to a and b, 
but none of them can be inferred from the givens. The physical instance of the 
diagram thus serves as a token, or artifact, that is intended to be used in certain 
ways; understanding the role of the diagram necessarily involves understanding 
the intended useH 

The second moral is that the physical instance of the diagram, taken out of 
context, does not bear all the relevant inferential data. In the example above, 
the diagram is symmetric: if we rotate the diagram a quarter turn and switch 
the order of the questions, the new diagram and questionnaire differs from the 
previous one only by the labels of the geometric objects; but whereas "yes" 
and then "no" are the correct answers to the first set of questions, "no" and 
then "yes" are the correct answers to the second. What this means is that the 
inferences that we are allowed to perform depend not just on the illustration, but 
also on the preamble; that is, the inference depends on knowing the construction 
that the diagram is supposed to illustrate. Hence, understanding the role of the 
diagram in Euclidean practice also involves understanding how the details of 
the construction bear upon the allowable inferences. 

In Nathaniel Miller's formal system for Euclidean geometry [33] , every time 
a construction step can give rise to different topological configurations, the proof 
requires a case split across all the possible configurations. His system provides 
a calculus by which one can determine (an upper bound on) all the realizable 
configurations (and systematically rule out some of the configurations that are 
not realizable). This can result in a combinatorial explosion of cases, and Miller 
himself concedes that it can be difficult to work through them all. (See also 
Mumma's review [4^.) Thus, although Miller's system is sound for the in- 
tended semantics and may be considered "diagrammatic" in nature, it seems 
far removed from the Elements, where such exhaustive case splits are nowhere to 
be found. (We will, however, have a lot more to say about the case distinctions 
that do appear in the Elements; see Sections 13.81 and HTHl ) 

Mumma's original proof system, Eu [321 [3H], used a different approach. Al- 
though proofs in Eu are based on particular diagrams, not every feature found 
in a particular diagram can be used in the proof. Rather, one can only use 
those features of the diagram that are guaranteed to hold generally, given the 
diagram's construction. Mumma's system therefore includes precise rules that 
determine when a feature has this property. Our system, E, pushes the level 
of abstraction one step further: in E the diagram is nothing more than the 

■^Danielle Macbeth 1291 has characterized this sort of diagram use in terms of the Gricean 
distinction between "natural" and "non-natural" meaning. Manders |32| underscores this 
point by observing that Euclidean diagrams are used equally well in reductio proofs, where 
the conclusion is that the illustrated configuration cannot exist. One finds a nice example of 
this in Proposition 10 of Book III, which shows that two distinct circles cannot intersect in 
more than two points. Clearly, in cases like this, the diagram does not serve as a "literal" or 
direct representation of the relevant configuration. 
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collection of generally valid diagrammatic features that are guaranteed by the 
construction. In other words, given the construction in the example above, we 
identify the diagram with the information provided by the construction — that 
a and b are distinct points, L is a line, a is on L, b is on L, c and d are on 
opposite sides of L, and so on — and all the direct diagrammatic consequences 
of these data. This requires us to spell out the notion of a "direct diagrammatic 
consequence," which is exactly what we do in Section [3.81 

2.4 The logical form of proofs in the Elements 

It is commonly noted that Euclid's proofs are constructive, in the sense that 
existence assertions are established by giving explicit constructions. One would 
therefore not expect Euclidean reasoning to use the full range of classical first- 
order logic, which allows nonconstructive existence proofs, but, rather, a suit- 
ably constructive fragment. 

In fact, when one surveys the proofs in the Elements, one is struck by how 
little logic is involved, by modern standards. Go back to the examples in Sec- 
tion 12. H and count the instances of logical staples like "every," "some," "or," 
and "if . . . then." The results may surprise you. 

Of course, the statements of the two propositions are best modeled with a 
universal quantifier: we can read Proposition 1. 10 as the assertion that "any 
finite straight line can be bisected" and Proposition 1.16 begins with the words 
"any triangle." Furthermore, there is an existential quantifier implicit in the 
statement of Proposition 1. 10, which, in modern terms, might be expressed "for 
every finite straight line, there is a point that bisects it." In modern terms, it 
is the existential quantifier implicit in the statement of Proposition 1. 10 that 
makes this proposition a "problem" in Proclus' terminology. There is no such 
quantifier implicit in Proposition 1.16, which is therefore a "theorem." 

Thus, in a Euclidean proposition, an explicit or implicit universal quantifier 
serves to set forth the givens, and, if the proposition is a "problem," an existen- 
tial statement is used to specify the properties of the objects to be constructed. 
What is remarkable is that these are the only quantifiers one finds in the text; 
the proof itself is purely quantifier-free. Not only that; the proof is virtually 
logic free. A construction step introduces new objects meeting certain specifi- 
cations; for example, the third line of the proof of Proposition 1. 10 introduces 
an equilateral triangle. We will see that in our formalization, the specification 
can always be described as a list of atomic formulas and their negations. Other 
lines in a Euclidean proof simply make atomic or negated atomic statements, 
like "the base ad is equal to the base M," sometimes chained together with the 
word "and." 

In other words, Euclidean proofs do little more than introduce objects sat- 
isfying lists of atomic (or negation atomic) assertions, and then draw further 
atomic (or negation atomic) conclusions from these, in a simple linear fashion. 
There are two minor departures from this pattern. Sometimes a Euclidean proof 
involves a case split; for example, if ab and cd are unequal segments, then one 
is longer than the other, and one can argue that a desired conclusion follows in 
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either case. The other exception is that Euchd sometimes uses a reductio; for 
example, if the supposition that ab and cd are unequal yields a contradiction 
then one can conclude that ab and cd are equal. In our formal system, such case 
splits are always case splits on the truth of an atomic formula, and a proof by 
contradiction always establishes an atomic formula or its negation. 

There is one more feature of Euclid's proofs that is worth calling attention 
to, namely, that in Euclid's proofs the construction steps generally precede the 
deductive conclusions. Thus, the proofs generally split into two phases: in the 
construction (kataskeue) phase, one carries out the construction, introducing all 
the objects that will be needed to reach the desired conclusion; and then in the 
deduction (apodeixis) phase one infers metric and diagrammatic consequences 
(see [36l pp. 159-160] or [161 vol. 1, pp. 129-130]). This division is not required 
by our formal system, which is to say, nothing goes wrong in our proof system 
if one constructs some objects, draws some conclusions, and then carries out 
another construction. In other words, we take the division into the two phases 
to be a stylistic choice, rather than a logical necessity. For the most part, one 
can follow this stylistic prescription within i?, and carry out all the constructions 
first. An exception to this occurs when, by E's lights, some deductive reasoning 
is required to ensure that prerequisites for carrying out a construction step are 
met. For example, we will see in Section 14.31 that our formal system takes 
issue with Euclid's proof of Proposition 1.2: where Euclid carries out a complex 
construction without further justification, our system requires an explicit (but 
brief) argument, amidst the construction, to ensure that a certain point lies 
inside a certain circle. But even Euclid himself sometimes fails to maintain 
the division between the two phases, and includes demonstrative arguments in 
the construction phase; see, for example, our discussion of Euclid's proof of 
Proposition 1.44, in Section 14.31 Thus, our interpretation of the usual division 
of a Euclidean proof into construction and deduction phases is supported by the 
text of the Elements itself. 

2.5 Nondegeneracy assumptions 

As illustrated by our examples, Euclid typically assumes his geometric configu- 
rations are nondegenerate. For example, if a and b are given as arbitrary points, 
Euclid assumes they are distinct points, and if abc is a triangle, the points a, b, 
and c are further assumed to be noncoUinear. These are also sometimes called 
"genericity assumptions" ; we are following Wu [65 in using the term "nonde- 
generacy." 

Insofar as these assumptions are implicit in Euclid, his presentation can be 
criticized on two grounds: 

1. The theorems are not always as strong as they can be, because the conclu- 
sions sometimes can still be shown to hold when some of the nondegeneracy 
constraints are relaxed. (Sometimes one needs to clarify the reading of the 
conclusion in a degenerate case.) 

2. There are inferential gaps: when Euclid applies a theorem to the diagram 
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obtained from a construction in the proof of a later theorem, he does not 
check that the nondegeneracy assumptions hold, or can be assumed to 
hold without loss of generality. 

With respect the second criticism, Wu writes: 

In the proof of a theorem, even though the configuration of the hy- 
pothesis at the outset is located in a generic, nondegenerate position, 
we are still unable to determine ahead of time whether or not the de- 
generate cases will occur when applying other theorems in the proof 
process. Not only is the verification of every applied theorem cum- 
bersome and difficult, but it is actually also impossible to guarantee 
that the degenerate cases (in which the theorem is meaningless or 
false) do not happen in the proof process. On the other hand, we 
have no effective means to judge how much to restrict the statement 
of a theorem (to be proved) in order to ensure the truth of the the- 
orem. These problems make it impossible for the Euclidean method 
of theorem proving to meet the requirements of necessary rigor. [651 
p. 118] 

Wu's comments refer to geometric theorem proving in general, not just the 
theorems of the Elements. With respect to the latter, we feel that the quote 
overstates the case: for the most part, the nondegeneracy requirements for 
theorem application in Euclid are easily met by assuming that the construction 
is appropriately generic. We discuss a mild exception in Section 14. 3( noting 
that, according to E, Euclid should have said a few more words in the proof of 
Proposition 1.9. But we do not know of any examples where substantial changes 
are needed. 

Furthermore, the first criticism is only damning insofar as the degenerate 
cases are genuinely interesting. Nonetheless, from a modern standpoint, it is 
better to articulate just what is required in the statement of a theorem. Thus, 
we have chosen to "go modern" with E, in the sense that any distinctness 
assumptions (inequality of points, non-incidence of points and lines) that are 
required have to be stated explicitly as hypotheses. Although this marks a 
slight departure from Euclid, the fact that all assumptions are made explicit 
provides a more fiexible framework to explore the issue as to which assumptions 
are implicit in his proofs. 

2.6 Our methodology 

We have cast our project as an attempt to model Euclidean diagrammatic proof, 
aiming to clarify its logical form, and, in particular, the nature of diagrammatic 
inference. In casting our project in this way, we are adopting a certain method- 
ological stance. From a logical standpoint, what makes a Euclidean proof "dia- 
grammatic" is not the fact that we find it helpful to consult a diagram in order 
to verify the correctness of the proof, or that, in the absence of such a physical 
artifact, we tend to roll our eyes towards the back of our heads and imagine 
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such a diagram. Rather, the sahent feature of Euchdean proof is that certain 
sorts of inferences are admitted as basic, and are made without further justifi- 
cation. When we say we are analyzing Euchdean diagrammatic reasoning, we 
mean simply that we are trying to determine which inferences have this basic 
character, in contrast to the geometrically valid inferences that are spelled out 
in greater detail in the text of the Elements. 

Our analysis may therefore seem somewhat unsatisfying, in the sense that 
we do not attempt to explain why the fundamental methods of inference in 
the Elements are, or can be, or should be, taken to be basic. This is not to 
imply that we do not take such questions to be important. Indeed, it is just 
because they are such obvious and important questions that we are taking pains 
to emphasize the restricted character of our project. 

What makes these questions difficult is that it is often not clear just what 
type of answer or explanation one would like. In order to explain why Euclidean 
practice is the way it is, one might reasonably invoke historical, pedagogical, or 
more broadly philosophical considerations. It may therefore help to highlight 
various types of analysis that are not subsumed by our logical approach. It does 
not include, per se, any of the following: 

• a historical analysis of how the Elements came to be and attained the 
features we have described; 

• a philosophical analysis as to what characterizes the inferences above as 
epistemically special (beyond that they interpret the ruler-and-compass 
constructions of modern geometric formalizations, and are sound and com- 
plete for the corresponding semantics), or in what sense they should be 
accepted as "immediate" ; 

• a psychological or cognitive or pedagogical analysis of the human abilities 
that make it possible, and useful, to understand proofs in that form; or 

• a computational analysis as to the most efficient data structures and algo- 
rithms for verifying the inferences we have characterized as "Euclidean," 
complexity upper and lower bounds, or effective search procedures. 

We do, however, take it to be an important methodological point that the 
questions we address here can be separated from these related issues. We hope, 
moreover, that the understanding of Euclidean proof that our analysis provides 
can support these other lines of inquiry. We return to a discussion of these 
issues in Section [71 

3 The formal system E 
3.1 The language of E 

The language of E is six-sorted, with sorts for points, lines, circles, segments, 
angles, and areas. There are variables ranging over the first three sorts; we use 
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variables a,b,c, . . . to range over points, L, M, N, . . . to range over lines, and 
Q, /3, 7, . . . to range over circles. In addition to the equality symbol, we have the 
following basic relations on elements of these sorts: 

• on(a, L): point a is on line L 

• same-side(a, b, L): points a and b arc on the same side of line L 

• between(a, 6, c): points a, b, and c are distinct and coUinear, and b is 
between a and c 

• on(a, a): point a is on circle a 

• inside(a, a): point a is inside circle a 

• center (a, a): point a is the center of circle a 

Note that between(a, b, c) denotes a strict betweenness relation, and same-side(o, b, 
entails that neither a nor b is on L. We also have three versions of an additional 
relation symbol, to keep track of the intersection of lines and circles: 

• intersects(i, M): line L and M intersect 

• intersects(i, a): line L intersects circle a 

• intersects ( a, /3): circles a and /3 intersect 

In each case, by "intersects" we really mean "intersects transversally." In other 
words, two lines intersect when they have exactly one point in common, and 
two lines, or a line and a circle, intersect when they have exactly two points in 
common. 

The objects of the last three sorts represent magnitudes. There are no 
variables ranging over these sorts; instead, one obtains objects of these sorts by 
applying the following functions to points: 

• segment (a, b): the length of the line segment from a to b, written ab 

• angle(a, 6, c): the magnitude of the angle a5c, written Aabc 

• area(a, 6, c): the area of triangle abc, written Aafec 

In addition to the equality relation, we have an addition function, +, a less- 
than relation, <, and a constant, 0, on each magnitude sort. Thus, for example, 
the expression ab = cd denotes that the line segment determined by a and b is 
congruent to the line segment determined by c and d, and ab < cd denotes that 
it is strictly shorter. The symbol is included for convenience; we could have, in 
a manner more faithful to Euclid, taken magnitudes to be strictly positive, with 
only minor modifications to the axioms and rules of inference described below. 
Finally, we also include a constant, "right-angle," of the angle sort. Thus we 
model the statement "abc is a right angle" as Zabc = right-angle. 
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The assertion "between(a, b, c)" is intended to denote that b is strictly be- 
tween a and c, which is to say, it imphes that b is not equal to either a or 
c. In Section O we will see that, in this respect, it differs from the primitive 
used by Tarski in his axiomatization of EucHdean geometry. One reason that 
we have chosen the strict version is that it seems more faithful to EucUdean 
practice; see the discussion in Section 12.51 Another is that it seems to have 
better computational properties; see Section [G] 

The atomic formulas are defined as usual. A literal is an atomic formula or 
a negated atomic formula. We will sometimes refer to literals as "assertions," 
since, as we have noted, statements found in proofs in the Elements are gener- 
ally of this form (or, at most, conjunctions of such basic assertions). Literals 
involving the relations on the first three sorts are "diagrammatic assertions," 
and literals involving the relations on the last three sorts are "metric assertions." 

Additional predicates can be defined in terms of the basic ones presented 
here. For example, we can take the assertion ab < cd to be shorthand for 
-i{cd < ab). Similarly, we can assert that a and b are on different sides 
of a line L, written diff-side(a, 5, L), by making the sequence of assertions 
-ion(a, L), -ion(6, i), -isame-side(a, 6, L). Similarly, we can define outside(a, a) 
to be the conjunction -iinside(a, a), -ion(a, a). Definitional extensions like these 
are discussed in Section |4?T1 

It is worth mentioning, at this point, that diagrammatic assertions like ours 
rarely appear in the text of Euclid's proofs. Rather, they are implicitly the 
result of diagrammatic hypotheses and construction steps, and they, in turn, 
license further construction steps and deductive inferences. But this fact is ad- 
equately captured by E: even though raw diagrammatic assertions may appear 
in proofs, the rules are designed so that typically they do not have to. Consider, 
for example, the example in Section 12.31 In our system, the construction "let 
e be the point of intersection of L and M" is licensed by the diagrammatic 
assertion intersects(L, M), which, in turn, is licensed by the fact that M con- 
tains two points, c and d, that are on opposite sides of L. But we will take 
the assertion intersects(L, M) to be a direct consequence of diagrammatic as- 
sertions that result from the construction, which allows this fact to license the 
construction step without explicit mention. And once e has been designated 
the point of intersection, the fact that e is between c and d is another direct 
consequence of the diagram assertions in play, and hence can be used to license 
future constructions and metric assertions. We discuss the relationship between 
our formal language and the informal text of the Elements in more detail in 
Section [in 

3.2 Proofs in E 

Theorems in E have the following logical form: 

Va, L, d {ip{a, L, a) 3b, M , f3 ip{a, b, L, AI , a, /3)), 

where (p is a conjunction of literals, and is either a conjunction of literals or 
the symbol _L, for "falsity" or "contradiction." Put in words, theorems in E 
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make statements of the following sort: 

Given a diagram consisting of some points, a, some lines, L, and 
some circles, a, satisfying assertions Lp, one can construct points 
&, lines M, and circles /3, such that the resulting diagram satisfies 
assertions i>. 

If the list 6, Af, (3 is nonempty, the theorem is a "problem," in Proclus' terminol- 
ogy. If that list is empty and ijj is not _L, we have a "theorem," in Proclus' sense. 
If -0 is ±, the theorem asserts the impossibility of the configuration described 
by ip. 

In our proof system, we will represent a conjunction of literals by the corre- 
sponding set of literals, and the initial universal quantifiers will be left implicit. 
Thus, theorems in our system will be modeled as sequents of the form 

F ^ 36, M, (3. A, 

where F and A are sets of literals, and b,M,(3 do not occur in F. Assuming 
the remaining variables in F and A are among a, L.a, the interpretation of the 
sequent is as above: given objects a,L,d satisfying the assertions in F, there 
are objects b, M, (3 satisfying the assertions in A. 

As is common in the proof theory literature, if F and F' are finite sets 
of literals and is a literal, we will use F, F' to abbreviate F U F' and F, to 
abbreviate F □{(/?}. Beware, though: in the literature it is more common to read 
sets on the right side of a sequent arrow disjunctively, rather than conjunctively, 
as we do. Thus the sequent above corresponds to the single-succedent sequent 
F =4> 3&, M, (3 (/\ A) in a standard Gentzen calculus for first-order logic. 

Having described the theorems in our system, we now describe the proofs. 
As noted in Section 12.41 there are two sorts of steps in a Euclidean proof: 
construction steps, which introduce new objects into the diagram, and deduction 
steps, which infer facts about objects that have already been introduced. Thus, 
after setting forth the hypotheses, a typical Euclidean proof might have the 
following form: 

Let a be a point such that . . . 
Let 6 be a point such that . . . 
Let L be a line such that . . . 

Hence . . . 
Hence . . . 
Hence . . . 

Application of a previously proved theorem fits into this framework: if the 
theorem is a "problem," in Proclus' terminology, applying it is a construction 
step, while if it is a "theorem," applying it is a demonstration step. The linear 
format is occasionally broken by a proof by cases or a proof by contradiction, 
which temporarily introduces a new assumption. For example, a proof by cases 
might have the following form: 
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Suppose A. 

Hence . . . 

Hence . . . 

Hence B. 
On the other hand, suppose not A. 

Hence . . . 

Hence . . . 

Hence B. 
Hence B. 

Proofs in E can be represented as sequences of assertions in this way, where 
the validity of the assertion given at any line in the proof depends on the hy- 
potheses of the theorem, as well as any temporary assumptions that are in play. 
Below, however, we will adopt conventional proof-theoretic notation, and take 
each line of the proof to be a sequent T => 3x. A, where F represents all the 
assumptions that are operant at that stage of the proof, x represent all the geo- 
metric objects that have been introduced, and A represents all the conclusions 
that have been drawn. 

Thus, in our formal presentation of the proof system, a single construction 
step involves passing from a sequent of the form F 3x. A to a sequent 
of the form F =^ 3x,y. A, A', where y are variables for points, lines, and/or 
circles that do not occur in the original sequent. That is, the step asserts the 
existence of the new objects, y, with the properties asserted by A'. In contrast, 
demonstration steps pass from a sequent of the form F =^ 3x. A to one of the 
form F 3a;. A, A', without introducing new objects. These include: 

• Diagrammatic inferences: here A' consists of a direct diagrammatic con- 
sequence of diagrammatic assertions in F, A; 

• Metric inferences: here A' consists of a direct metric consequence of metric 
assertions in F, A; and 

• Transfer inferences: here A' consists of a metric or diagrammatic asser- 
tion that can be inferred from metric and diagrammatic diagrammatic 

assertions in F, A. 

We will describe these inferences in detail in the sections that follow. 

We have already noted that applying a previously proved theorem may or 
may not introduce new objects. Suppose we have proved a theorem of the form 
H ^ 3^. 6, and we are at a stage in our proof where we have established 
the sequent F => 3x. A. The first theorem, that is, the hypotheses in H, 
may concern a right triangle abc, whereas we may wish to apply it to a right 
triangle def. Thus, the inference may require renaming the variables of the first 
theorem. Furthermore, we may wish to extract only some of the conclusions 
of the theorem, and discard the others. Applying such a theorem, formally, 
involves doing the following: 
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• renaming the variables of 11 => 3y. Q to obtain a sequent 11' ^ 3^*. Q', so 
that all the free variables of that sequent are among the variables of F, A, 
and the variables do not occur in F, A; 

• checking that every element of H' is a direct diagram or metric consequence 
ofF,A; 

• selecting some subset A' of the conclusions 0' and the sublist z of variables 
from among if that occur in O'; 

• and then concluding the sequent F 3x, z. A, A'. 

In words, suppose that, assuming that some geometric objects satisfy the as- 
sertions F, we have constructed objects x satisfying A. Suppose, further, that, 
by a previous theorem, the assertions in F and A imply the existence of new 
objects z satisfying A'. Then we can introduce new objects z, satisfying the 
assertions in A'. 

We also adhere to the common proof-theoretic practice of representing our 
proofs as trees rather than sequences, where the sequent at each node is inferred 
from sequents at the node's immediate predecessors. For the most part, trees 
will be linear, in the sense that each node has a single predecessor. The only 
exceptions arise in a proof by cases or a proof by contradiction. In the first 
case, one can establish a conclusion using a case split on atomic formulas. Such 
a proof has the following form: 

F ^ 3f. A F, A, (/? =5> 3y. A' F, A, -.(^ ^ 3y. A' 
F ^ 3f,y. A, A' 

In words, suppose that, given geometric objects satisfying the assertions F, we 
have constructed objects x satisfying A. Suppose, further, that given objects 
satisfying F and A, we can construct additional objects y satisfying A', whether 
or not 93 holds. Then, given geometric objects satisfying the assertions F, we 
can obtain objects x^ y satisfying the assertions in A, A'. 

Recall that we have included the symbol -L, or "contradiction," among our 
basic atomic assertions. Since the rules described below allow one to infer 
anything from a contradiction, we can use case splits to simulate proof by con- 
tradiction, as follows. Suppose, assuming -up, we establish _L. Then from -k^ 
we can establish Lp. Since p certainly follows from Lp, we have shown that p 
follows in any case. 

Finally, we need to model two "superposition" inferences used by Euclid 
in Propositions 4 and 8 of Book I, to establish the familiar "side-side-side" 
and "side-angle-side" criteria for triangle congruences. The interpretation of 
these rules has been an ongoing topic of discussion for Euclid's commentators 
(see Heath [H pp.224-228,249-250], Mancosu [3D1 pp. 28-33], or Mueller [371 
pp. 21-24]). But the inferences have a very natural modeling in our system, 
described in Section [3771 below. 

A proof that ends with the sequent F =^ 3x' . A' constitutes a proof of 
F =^ 3x. A exactly when there is a map / from x to the variables of F, A' such 
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that, under the renaming, every element of A-^ is contained in or a diagrammatic 
consequence of A'. In other words, we have succeeded in proving the theorem 
when we have constructed the requisite objects and shown that they have the 
claimed properties 

We claim that our formal system captures all the essential features of the 
proofs found in Books I to IV of the Elements. To be more precise, the Elements 
includes a number of more complicated inferences that are easily modeled in 
terms of our basic rules. To start with, Euclid often uses more elaborate case 
splits than the ones defined above, for example, depending on whether one 
segment is shorter than, the same length as, or longer than another. This is 
easily represented in our system as a sequence of two case splits. Also, Euclid 
often implicitly restricts attention to one case, without loss of generality, where 
the treatment of the other is entirely symmetric. Furthermore, we have focused 
on triangles; the handling of convex figures like rectangles and their areas can be 
reduced to these by introducing defined predicates. In Section |4T| we describe 
some of the ways that "syntactic sugar" could be used to make E^s proofs even 
more like Euclid's. Thus a more precise formulation of our claim is that if we use 
a suitable textual representation of proofs, then, modulo syntactic conventions 
like these, proofs in our formal system look very much like the informal proofs 
found in the Elements^ Some examples are presented in Section 14.21 below to 
help substantiate this claim. Some ways in which proofs in our system depart 
substantially from the text of the Elements are discussed in Section 14.31 

To complete our description of E, we now need to describe: 

1. the construction rules, 

2. the diagrammatic inferences, 

3. the metric inferences, 

4. the diagram-metric transfer inferences, and 

5. the two superposition inferences. 

These are presented in Sections I3.3H3.7I The diagrammatic inferences, metric 
inferences, and diagram-metric transfer inferences will be presented as lists of 

•^Note that the function / can map an existentially quantified variable in x to one of the 
variables in F. This means that the theorem "assuming p is on L, there is a point q on L" 
has the trivial proof: "assuming p is on L, p is on L." 

We are, however, glossing over some technical details concerning the usual treatment of 
bound variables and quantifiers. For example, technically, we should require that no variable 
of F conflict with the bound variables x of the sequent. It may be convenient to assume that 
we simply use separate stocks of variables for free (implicitly universally quantified) variables 
and bound (existentially quantified) variables. Or, better, one should construe all our claims 
as holding "up to renaming of bound variables." 

* The manner of presenting proofs used above, whereby suppositional reasoning is indicated 
by indenting or otherwise setting off subarguments, amounts to the use of what are known as 
"Fitch diagrams." 

Since the objects constructed to satisfy the conclusion of a proof by cases can depend on 
the case, we have glossed over details as to how our formal case splits should be represented 
in Fitch-style proofs. But see the second example in Section 14.51 for one way of doing this. 
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first-order axioms, wliereas wliat we really mean is that in a proof one is allowed 
to introduce any "direct consequence" of those axioms. This requires us to 
spell out a notion of "direct consequence," which we do in Section 13.81 In the 
meanwhile, little harm will come of thinking of the direct consequences as being 
the assertions that are first order consequences of the axioms, together with the 
assertions in F, A. 

3.3 Construction rules 

In this section, we present a list of construction rules for E. Formally, these 
are described by sequents of the form 11 =^ 3x. Q, where the variables x do 
not appear in 11. Applying such a construction rule means simply applying this 
sequent as a theorem, as described in the last section. In other words, one can 
view our construction rules as a list of "built-in" theorems that are available 
from the start. Intuitively, x are the objects that are constructed by the rule; 
n are the preconditions that guarantee that the construction is possible^ and 
G are the properties that characterize the objects that are constructed. 

We pause to comment on our terminology. What the rules below have in 
common is that they serve to introduce new objects to the diagram. Sometimes 
an object that is introduced is uniquely determined, as is the case, for example, 
with the rule "let a be the intersection of L and 7\f ." In other cases, there is 
an arbitrary choice involved, as is the case with the rule "let a be a point on 
L" . We are referring to both as "construction rules," though one might object 
that picking a point is not really a "construction." It might be more accurate to 
describe them as "rules that introduce new objects into the diagram," but we 
have opted for the shorter locution. Our choice is made reasonable by the fact 
that the rules are all components of Euclidean constructions. Insofar as picking 
a point c and connecting it to two points a and b can be seen as "constructing 
a triangle on the segment ab," it is reasonable to call the rule that allows one 
to pick c a "construction rule." 

For readability, the sequents are described informally. First, we provide a 
natural-language description of the construction, such as "let a be a point on 
L." This is followed by a more precise specification of the prerequisites to the 
construction (corresponding to 11 in the sequent 11 =^ 3x. Q), and the conclusion 
(corresponding to Q). Furthermore, when one constructs a point on a line, for 
example, one has the freedom to choose such a point distinct from any of the 
other points already in the diagram, and to specify that it does not lie on various 
lines and circles. The ability to do so is indicated by the optional "[distinct 
from . . .]" clause; for example, assuming the lines L and M do not coincide, 
one can say "let a be a point on L, distinct from b, M , and a." As noted in 
Section [2.51 both the ability to specify, and the requirement of specifying, such 
"distinctness" conditions marks a departure from Euclid. In the presentation 
of the construction rules below, such conditions are abbreviated "[distinct from 

^The conditions that are prerequisite to a construction are called the diarismos by Proclus; 
see [m Book I, p. 130] or [Ml P- 160]. 
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...]." Similarly, the requirement that L be distinct from all the other lines 
mentioned is abbreviated "[L is distinct from lines ...]," and so on. So the 
example we just considered is an instance of the second rule on the list that 
follows, and becomes 

L ^ M 3a. on{a, L),a^ b, -■on(a, M), -■on(a, a) 

when expressed in sequent form. 

Points 

1. Let a be a point [distinct from . . .]. 
Prerequisites: none 
Conclusion: [a is distinct from. . . ] 

2. Let a be a point on L [distinct from . . . ]. 

Prerequisites: [L is distinct from lines. . . ] 
Conclusion: a is on L, [a is distinct from. . . ] 

3. Let a be a point on L between b and c [distinct from . . . ]. 
Prerequisites: b is on L, c is on L, 6 ^ c, [L is distinct from lines . . . ] 
Conclusion: a is on L, a is between b and c, [a is distinct from. . . ] 

4. Let a be a point on L extending the segment from 6 to c [with a distinct 
from. . . ] . 

Prerequisites: b is on L, c is on L, 6 ^ c, [L is distinct from lines . . . ] 
Conclusion: a is on L, c is between b and a, [a is distinct from. . . ] 

5. Let a be a point on the same side of L as 6 [distinct from. . . ] 

Prerequisite: b is not on L 

Conclusion: a is on the same side of L as 6, [a is distinct from. . . ] 

6. Let a be a point on the side of L opposite b [distinct from. . . ] 
Prerequisite: b is not on L. 

Conclusion: a is not on L, a is on the same side of L as b, [a is distinct 
from. . . ] 

7. Let a be a point on a [distinct from . . . ] . 
Prerequisite: [a is distinct from other circles] 
Conclusion: a is on a, [a is distinct from. . . ] 

8. Let a be a point inside a [distinct from . . . ]. 

Prerequisites: none 

Conclusion: a is inside a, [a is distinct from. . . ] 

9. Let a be a point outside a [distinct from . . . ]. 
Prerequisites: none 

Conclusion: a is outside a, [a is distinct from. . . ] 
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Lines and circles 



1. Let L be the line through a and 6. 

Prerequisite: a^h 
Conclusion: a is on i, 6 is on L 

2. Let a be the circle with center a passing through h. 
Prerequisite: a^b 

Conclusion: a is the center of a, 6 is on a 

To make sense of the next list of constructions, recall that we are using the 
word "intersect" to refer to transversal intersection. For example, saying that 
two circles intersect means that they meet in exactly two distinct points. 

Intersections 

1. Let a be the intersection of L and M . 
Prerequisite: L and M intersect 
Conclusion: a is on L, a is on M 

2. Let a be a point of intersection of a and L. 
Prerequisite: a and L intersect 
Conclusion: a is on a, a is on X 

3. Let a and h be the two points of intersection of a and L. 
Prerequisite: a and L intersect 

Conclusion: a is on a, a is on L, b is on a, b is on L, a ^ b 

4. Let a be the point of intersection of L and a between b and c. 
Prerequisites: b is inside a, b is on L, c is not inside a, c is not on a, c is 
on L 

Conclusion: a is on a, a is on L, a is between b and c 

5. Let a be the point of intersection of L and a extending the segment from 
c to b. 

Prerequisites: b is inside a, 6 is on L, c ^ 6, c is on L. 
Conclusion: a is on a, a is on L, b is between a and c 

6. Let a be a point on the intersection of a and /3. 

Prerequisite: a and (3 intersect 
Conclusion: a is on a, a is on /3 

7. Let a and b be the two points of intersection of a and /?. 
Prerequisite: a and /? intersect 

Conclusion: a is on a, a is on /?, b is on a, 6 is on /3, a 7^ 6 
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Figure 1: Diagrams for intersection rules 8 (left) and 9 (right). In the first, the 
added intersection point a is on the same side of L as b; in the second, it is 
opposite b. 

8. Let a be the point of intersection of a and /?, on the same side of L as &, 
where L is the line through their centers, c and d, respectively. 
Prerequisites: a and /3 intersect, c is the center of a, d is the center of /3, 
c is on L, d is on L, b is not on L 

Conclusion: a is on a, a is on (3, a and b are on the same side of L 

9. Let a be the point of intersection of a and /?, on the side of L opposite b, 
where L is the line through their centers, c and d, respectively. 
Prerequisite: a and (3 intersect, c is the center of a, d is the center of /3, 
c is on L, d is on L, b is not on L 

Conclusion: a is on a, a is on /3, a and b are not on the same side of L, a 
is not on L. 

We close this section by noting that there is some redundancy in our con- 
struction rules. For example, the circle intersection rules 8 and 9, which are 
somewhat complex, could be derived as theorems from the more basic rules. As 
we will see below, we have added them to model particular construction steps 
in the Elements. But there are other constructions that can be derived in our 
system, that seem no less obvious; for example, if M and N are distinct lines 
that intersect, and a is not on N, then one can pick a point 6 on M on the same 
side of N as a. We did not include this rule only because we did not find it 
in Euclid, though constructions like this come up in our completeness proof, in 
Section [5] 

This situation is somewhat unsatisfying. Our list of construction rules was 
designed with two goals in mind: first, to model the constructions in Euclid, 
and, second, to provide a system that is complete, in the sense described in 
Section [51 But a smaller set of rules would have met the second constraint, and 
since the constructions appearing in Books I to IV of the Elements constitute a 
finite list, the first constraint could be met by brute-force enumeration. What 
is missing is a principled determination of what should constitute an "obvious" 
construction, as opposed to an existence assertion that requires explicit proof. 

We did, at one point, consider allowing the provcr to introduce any point 
satisfying constraints that are consistent with the current diagram. Even for 
diagrams without circles, however, determining whether such a list of constraints 
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meets this criterion seems to be a knotty combinatorial problem. And since 
circles can encode metric information, in that case the proposal seems to allow 
users to do things that are far from obvious. In any event, it is not clear that 
this proposal comes closer to characterizing what we should take as "obvious 
constructions." We therefore leave this task as an open conceptual problem, 
maintaining only that the list of constructions we have chosen here are (1) 
obviously sound, in an informal sense; (2) sufficient to emulate the proofs in 
Books I to IV of the Elements; (3) sound for the intended semantics; and (4) 
sufficient to make the system complete. 

3.4 Diagrammatic inferences 

We now provide a list of axioms that allow us to infer diagrammatic assertions 
from the diagrammatic information available in a given context in a proof. For 
the moment, these can be read as first-order axioms; the precise sense in which 
they can be used to license inferences in E is spelled out in Section [3?8l 

Generalities 

1. If a 7^ 6, a is on L, and b is on L, a is on M and b is on M, then L = M. 

2. If a and b are both centers of a then a = b. 

3. If a is the center of a then a is inside a. 

4. If a is inside a, then a is not on a. 

The first axiom above says that two points determine a line. It is logically 
equivalent to the assertion that the intersection of two distinct lines, L and M, 
is unique. The next two axioms tell us that the center of a circle is unique, and 
inside the circle. The final axiom then rules out "degenerate" circles. 

Between axioms 

1. If 6 is between a and c then b is between c and a, a ^ b, a ^ and a is 
not between b and c. 

2. If b is between a and c, a is on L, and b is on L, then c is on L. 

3. If b is between a and c, a is on L, and c is on L, then b is on L. 

4. If b is between a and c and d is between a and b then d is between a and 
c. 

5. If 6 is between a and c and c is between b and d then b is between a and 
d. 

6. If a, b, and c are distinct points on a line L, then then either b is between 
a and c, or a is between b and c, or c is between a and b. 
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7. If b is between a and c and b is between a and d then b is not between c 
and d. 

Axioms 1, 4, 5, and 6 are essentially the axioms for "between" given in 
Krantz et al. [T2] , with the minor difference that we are axiomatizing a "strict" 
notion of betweenness instead of a nonstrict one. Krantz et al. show that a 
countable set satisfies these axioms if and only if it can be embedded as a set 
of points on the real line. We remark, in passing, that it would be interesting 
to have similar completeness or representation theorems for other groups of the 
axioms found here. Our approach has been syntactic rather than semantic, 
which is to say, our goal has been to capture certain deductive relationships 
rather than to characterize classes of structures; but it would be illuminating to 
understand the extent to which our various groups of axioms give rise to natural 
classes of structures. 

The last axiom is illustrated by the following diagram: 

"a 'b *c ^ 

The axiom states that if d and c are on the same side of b along a line, then 
b does not fall between them. This axiom is, in fact, a first-order consequence 
of the others; it is therefore only useful in contexts where we consider more 
restrictive notions of consequence, as we do in Section [3.81 

Same side axioms 

1. If a is not on L, then a and a are on the same side of L. 

2. If a and b are on the same side of L, then b and a are on the same side of 
L. 

3. If a and b are on the same side of L, then a is not on L. 

4. If a and b are on the same side of L, and a and c are on the same side of 
L, then b and c are on the same side of L. 

5. If a, &, and c are not on L, and a and b are not on the same side of L, 
then either a and c are on the same side of L, or b and c are on the same 
side of L. 

If L is a line, the axioms imply that the relation "falling on the same side of 
L" is an equivalence relation; and any point a not on L serves to partition the 
points into three classes, namely, those on L, those on the same side of L as a, 
and those on the opposite side of L from a. 

With the interpretation of diff-side(p, q, L) described in Section [01 the ax- 
ioms imply that if a and b are on different sides of L and a and c are on different 
sides of L, then b and c are on the same side of L. The axioms also imply that 
if a and b are on the same side of L and a and c are on different sides of L then 
b and c are on different sides of L. 

Pasch axioms 
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Figure 2: Pasch rules 1 (left), 2 (center), and 3 and 4 (right). 

b 




Figure 3: the Pasch axiom 



1. If 6 is between a and c and a and c are on the same side of L, then a and 
b are on the same side of L. 

2. If b is between a and c and a is on L and b is not on L, then 6 and c are 
on the same side of L. 

3. If b is between a and c and & is on L then a and c are not on the same 



4. If b is the intersection of distinct lines L and M, a and c are distinct points 
on M , a ^ b, c ^ b, and a and c are not on the same side of L, then b is 
between a and c. 

These axioms serve to relate the "between" relation and the "same side" 
relation. In the fourth axiom, "6 is the intersection of distinct lines L and M" 
should be understood as "L ^ M , b is on L, and b is on M." 

In the literature, the phrase "Pasch axiom" is used to refer to the assertion 
that a line passing through one side of a triangle necessarily passes through one 
of the other two sides, or their point of intersection (see Figure This axiom 
was indeed used by Pasch gB] , and later by Hilbert [55] , with attribution. The- 
orems of E do not allow disjunctive conclusions, but one can use the conclusion 
of Pasch's theorem to reason disjunctively in a proof: in Figure [31 either c is on 
L, or on the same side of L as a, or on the same side of L as b. In the second 
case, where a and c are on the same side of L, our third Pasch axiom (together 
with the same-side axioms) imply that b and c are on opposite sides of L. The 
intersection rules below then tell us that the line through b and c intersects L. 
Our fourth Pasch axiom then implies that this intersection is between b and c. 
The third case is handled in a similar way. We have therefore chosen the name 
for this group of axioms to indicate that they provide an analysis of the usual 
Pasch axiom into more basic diagrammatic rules. 



side of L. 
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Figure 4: Triple incidence rules. (The same diagram illustrates all three rules.) 

Triple incidence axioms 

1. If L, M, and N are lines meeting at a point a, and 6, c, and d are points 
on L, M , and N respectively, and if c and d arc on the same side of L, 
and b and c are on the same side of N, then b and d are not on the same 
side of M. 

2. If L, M , and N are lines meeting at a point a, and 6, c, and d are points 
on L, M, and N respectively, and if c and d are on the same side of L, 
and b and d are not on the same side of M, and d is not on M and b ^ a, 
then 6 and c are on the same side of N . 

3. If L, Af , and N are lines meeting at a point a, and 6, c, and d are points 
on L, Af, and respectively, and if c and d are on the same side of L, 
and & and c are on the same side of TV, and d and e are on the same side 
of Af, and c and e are on the same side of N , then c and e are on the same 
side of L. 

These axioms explain how three lines intersecting in a point divide space into 
regions (see diagram 13. 4p . 

Circle axioms 

1. If a, 6, and c are on L, a is inside a, b and c are on a, and b ^ c, then a 
is between b and c. 

2. If a and b are each inside a or on a, and c is between a and 5, then c is 
inside a. 

3. If a is inside a or on a, c is not inside a, and c is between a and 6, then 6 
is neither inside a nor on a. 

4. Let a and /3 be distinct circles that intersect in distinct points c and d. 
Let a be a the center of a, let b be the center of /3, and let L be the line 
through a and 6. Then c and d are not on the same side of L. 

Intersection rules 
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Figure 5: Circle axioms 1-4. 



1. If a and 6 are on different sides of i, and M is the line through a and 6, 
then L and M intersect. 

2. If a is on or inside a, h is on or inside a, and a and b are on different sides 
of L, then L and a intersect. 

3. If a is inside a and on L, then L and a intersect. 

4. If a is on or inside a, b is on or inside a, a is inside f3, and 6 is outside f3, 

then a and (3 intersect. 

5. If a is on a, b is in a, a is in /?, and 6 is on /?, then a and /? intersect. 

Recall that "intersection" means transversal intersection. The first axiom says 
that a line passing from one side of L to the other intersects it. The second 
axiom says that if a is a circle that straddles L, then a intersects L. The third 
axiom says that a line that passes through a circle intersects it. The fourth and 
fifth axioms are the analogous properties for circles. The third axiom can be 
viewed as the assertion that a line cannot be bounded by a circle; the others 
can be viewed as continuity principles. 



Equality axioms 

1. X = X 

2. U X = y and (p{x), then (p{y) 

Here x and y can range over any of the sorts (that is, there is an equality symbol 
for each sort) and tp can be any atomic formula. These are the usual equality 
axioms for first-order logic, and so may be taken to be subsumed under the 
notion of "first-order consequence." 



3.5 Metric inferences 

Consider the structure (K"'", 0, -|-, <), that is, the nonnegative real numbers with 
zero, addition, and the less-than relation. It is well known that the theory of 
this structure is decidable. The set of universal consequences of this theory (or, 
equivalently, the set of quantifier-free formulas that are true of the structure 
under any assignment to the free variables) can be axiomatized as follows: 

• + is associative and commutative, with identity 0. 
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• < is a linear ordering with least element 0. 

• For any x, y, and z, ii x < y then x -\- z < y + z. 

Equivalently, these axioms describe the nonnegative part of any linearly ordered 
abelian group. Happily, these are the general properties Euclid assumes of 
magnitudes, that is, the segment lengths, angles, and areas in our formalization 
(see Stein [531 P- 167]). To be more precise, Euclid seems to assume that his 
magnitudes are strictly positive. But we have already noted in Section [3. II that 
we simply include for convenience; we could just as well have axiomatized the 
strictly positive reals. The axioms above imply that li x + z — y + z, then x = z, 
which corresponds to Euclid's common notion 3, "if equals be subtracted from 
equals, the remainders are equal." The third axiom implies that if < y, then 
z < y + z, which corresponds to common notion 5, "the whole is greater than 
the part." 

In addition to these, we include the following axioms, which Euclid seems to 
take to be clear from the definitions (modulo the caveat, in the last paragraph, 
that we include as a magnitude): 

1. a6 = if and only if a = 6. 

2. ^ > 

3. ab = ba. 

A. a ^ b and a ^ c imply Aabc = Zcba. 

5. < Zabc and Zabc < right-angle + right-angle. 

6. Aaab = 0. 

7. Aabc > 0. 

8. Aabc = Acab and Aabc = Aacb. 

9. If ab = a'b', be = b'd , ca — da' , /Labc = Aa'b'c' , Z.bca = Zb'c'a' , and 
Zcab = Zc'a'b', then Aabc = Aa'b'c'. 

Note that we do not ascribe any meaning to the magnitude Zabc when 6 = a or 
b — c. As axiom 6 indicates, however, we take "degenerate" triangles to have 
area 0. Once Euclid has proved two triangles congruent (that is, once he has 
shown that all their parts are equal), he uses the fact that they have the same 
area, without comment. The last axiom simply makes this explicit. 

Of course, there are further properties involving magnitudes that can be read 
off from a diagram, and, conversely, metric considerations can imply diagram- 
matic facts. These "transfer inferences" are the subject of the next section. 
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3.6 Transfer inferences 



We divide the transfer inferences into three groups, depending on whether they 
involve segment lengths, angles, or areas. 

Diagram-segment transfer axioms 

1. If is between a and c, then ab + be ~ Tie. 

2. If a is the center of a and /3, b is on a, c is on and ab — ac, then a — f3. 

3. If a is the center of a and 6 is on a, then 7Tc — ab if and only if c is on a. 

4. If a is the center of a and 6 is on a, and ac < ab ii and only if c is in a. 

The second axiom implies that a circle is determined by its center and radius. 
In the discussion in Section 14. 3[ we will explain that this is a mild departure 
from Euclid's treatment of circles. (Euclid seems to rely on a construction rule 
which has the same net effect.) When a = (3, this axiom implies the converse 
direction of the equivalence in axiom 3 (so that axiom could be stated instead 
as an implication). 

Diagram-angle transfer axioms 

1. Suppose a ^ b, a =^ c, a is on L, and b is on L. Then c is on L and a is 
not between b and c if and only if Zbac — 0. 

2. Suppose a is on L and M, b is on L, c is on A/, a ^ q, a ^ c, d is not on 
L or M, and L ^ M. Then Zhac = Zbad + Zdac if and only if b and d 
are on the same side of M and c and d are on the same side of L. 

3. Suppose a and b are points on L, c is between a and 6, and d is not on L. 
Then Zacd = Adcb if and only if Aacd is equal to right-angle. 

4. Suppose a, &, and b' are on i, a, c, and c' are on Af, b ^ a, b' ^ a, c ^ a, 
c' ^ a, a is not between b and 6', and a is not between c and c'. Then 
Z6ac = Zb'ac' . 

5. Suppose a and b are on L, & and c are on M, and c and d are on N. Suppose 
also that b ^ c, a and d are on the same side of N , and Aabc + Z6cd < 
right-angle -I- right-angle. Then L and N intersect, and if e is on L and 
TV, then e and a are on the same side of M . 

The first axiom says that if a and b are distinct points on a line L, then a point 
c is on L on the same side of a as 6 if and only if Z.bac = 0. The right-hand 
side of the equivalence in the second axiom can be read more simply as the 
assertion that d lies inside the angle bac. Thus the axiom implies that angles 
sum in the expected way. The third axiom corresponds to Euclid's definition 
10, "when a straight line set up on a straight line makes the adjacent angles 
equal to one another, each of the equal angles is called right. . . ." It also, at the 
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Figure 6: diagram-angle transfer axiom 5. 

same time, codifies postulate 4, "all right angles are equal to one another," using 
the constant, "right-angle," to describe the magnitude that all right angles are 
equal to. The fourth axiom says that different descriptions of the same angle 
are equal; more precisely, if ah and ab' are the same ray, and likewise for ac and 
ac', then ahc and ah'c are equal. 

Euclid's wording may make it seem more natural to use a predicate to assert 
that ahc forms a right angle, rather than using a constant, "right-angle," to 
denote an arbitrary right angle. But Euclid seems to refer to an arbitrary right 
angle in his statement of this parallel postulate, which, in the Heath translation, 
states: 

That, if a straight line falling on two straight lines make the interior 
angles on the same side less than two right angles, the two straight 
lines, if produced indefinitely, meet on that side on which are the 
angles less than the two right angles, [ini p. 155] 

Formulated in this way, a better name for the axiom might be the "non-parallel 
postulate" : it asserts that if the diagram configuration satisfies the given metric 
constraints on the angles, then two of the lines are guaranteed to intersect. The 
postulate translates to the last axiom above, which licenses the construction "let 
e be the intersection of L and iV." Furthermore, assuming e is the intersection 
of L and N , the postulate specifies the side of M on which e lies. 

Diagram-area transfer ZLxioms 

1. If a and b are on L and a ^ h, then Aabc = if and only if c is on L. 

2. If a, &, c are on L and distinct from one another, d is not on L, then c is 
between a and b if and only if Aacd + Adcb — Aadb. 

The second axiom implies that when a triangle is divided in two, the areas sum 
in the expected way. 

3.7 Superposition 

We now come to the final two inferences in our system, Euclid's notorious "su- 
perposition inferences," which vexed commentators through the ages (see the 
references in Section r3.2p . Euclid's Proposition 1.4 states the familiar "side- 
angle-side" property, namely that if two triangles abc and def are such that 
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Figure 7: superposition 



ab, ac are congruent to de, df respectively, and bac is congruent to angle edf, 
then the two triangles are congruent. The proof proceeds by imagining abc 
superimposed on def. In the Heath translation: 

For, if the triangle abc be applied to the triangle def, and if the 
point a be placed on the point d and the straight line ab on de, then 
the point b will also coincide with e, because ab is equal to de.. . . [16\ 
p. 247] 

At issue is what it means to "apply" abc to another triangle in such a way. 
Euclid has not yet proved that one can construct a copy of a'b'c' of abc that 
will meet the given constraints. This requires one to be able to copy a given 
angle, which is Euclid's Proposition 1.23. The chain of reasoning leading to that 
proposition includes Proposition 1.4 as a component. The same issue arises in 
the proof of Proposition 1.8, which uses a superposition argument to establish 
the "side-side-side" property. 

How, then, shall we treat superposition? One possibility is simply to add 
two new construction rules. The first would assert that given an angle abc, a 
point d on a line L, a point g on L, and a point h not on L, one can construct 
points a' , b', c' such that a' = d, Za'b'c' = Zabc, b' lies on L in the direction 
determined by g, and c' lies on the same side of L as h. The second says that 
given a triangle abc, a point c? on a line L, a point g on L, and a point h not on L, 
once can find points a', b' , d as above with ab, be, ca congruent to a'b' , b'c' , da!, 
respectively. These new construction rules would certainly allow us to carry out 
the proofs of Propositions 1.4 and 1.8, but the solution is not at all satisfying: 
Euclid takes great pains to derive the fact that one can carry out constructions 
like these, using Propositions 1.4 and 1.8 along the way. 

A second possibility is simply to add Propositions 1.4 and 1.8, the SAS and 
SSS properties, as axioms. But, once again, this is not a satisfactory solution, 
since it fails to explain why Euclid takes the trouble to prove them. 

Our formulation of E provides a third, more elegant solution. What super- 
position allows one to do is to act as though one has the result of doing the 
constructions above, but only for the sake of proving things about objects that 
are already present in the diagram. In proof-theoretic parlance, superposition 
is used as an elimination rule: if you can derive a conclusion assuming the exis- 
tence of some new objects, you can infer that the conclusion holds without the 
additional assumption. In Euclid's case, one is barred, however, from using the 
assumption to construct new objects. 
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This has a straightforward formulation as a sequent inference. Suppose F, A 
includes assertions to the effect that abc are distinct and noncoUinear, and g, 
L, and h are as above. Let Hi be the set 

{a' = d, Za'b'c' = Zabc, on(6', L), -ibetween(6', d, g), samc-side(c', h, L)} 

corresponding to the result of SAS superposition, and let 112 be the set 

{a' = d,ab = a'b', be = b'c',ca = da', on{b', L), -ibetween(6', d, g), same-side(c', h, L)} 

corresponding to the results of SSS superposition. Then the rules can be ex- 
pressed as 

r=>3f. A r,A,ni^A^ 

r ^ 3x. A, A' 
where i is equal to 1, 2, respectively. 

3.8 The notion of a "direct consequence" 

We have characterized "the diagram" in a Euclidean proof as the collection 
of diagrammatic facts that have been established, either by construction or by 
inference, at a given point in the proof; and we have characterized the "diagram- 
matic inferences" as those diagrammatic facts that are "direct consequences" of 
those. The goal of this section is to complete the description of E by spelling 
out an adequate notion of "direct consequence." 

Our attempts to define such a notion are constrained by a number of desider- 
ata. The first is fidelity to Euclid: 

• The direct consequences of a set of diagrammatic hypotheses should pro- 
vide an adequate model of the diagrammatic facts that Euclid makes use 
of in a proof, either explicitly or in licensing a construction or a metric 
conclusion, without explicit justification. 

The next two are more mathematical: 

• Any direct consequence should be, in particular, a first-order consequence 
of the diagrammatic axioms and diagrammatic facts in F, A. 

• Conversely, any diagrammatic assertion that is a first-order consequence of 
the diagrammatic axioms should be derivable in E, though not necessarily 
in one step. 

The first constraint says that direct consequences of a set of diagrammatic 
assertions should be sound with respect to the set of first-order consequences 
of the diagrammatic axioms. The second constraint says that together with 
the other methods of proof provided by E, they should be complete as well. 
We will see that there is a lot of ground between these two constraints. For 
example, they can be met by taking the direct consequences to be all first-order 
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consequences. But this overshoots our first desideratum, since it would let us 
make direct inferences that Euclid spells out more explicitly. Nor does it sit well 
with the notion of "directness." Since we are dealing with a universal theory in 
a language with no function symbols, the set of literals that are consequences of 
a given set F of literals is decidable: one only need extract all instances of the 
axioms among the variables in F, and use a decision procedure for propositional 
logic. But this is unlikely to be computationally feasiblel^ and we expect a 
"direct" inference to be more tame than that. Thus our third desiderata is of a 
computational nature: 

• The problem of determining whether a literal is a direct consequence 
of some diagrammatic facts should be, in some sense, computationally 
tractable. 

The notion of tractability should be taken with a grain of salt. It is loosely re- 
lated to the practical question as to whether one can implement a proof checker 
for our formal system which performs reasonably on formalized proofs of state- 
ments in the Elements, a question we address in Section [6] But it is worth 
keeping in mind that even our theoretical characterization is only intended to 
be compelling at the level of complexity found in proofs in the Elements. When 
a diagram has millions of points, lines, and circles, we may be faulted for sanc- 
tioning "direct" inferences that cannot be carried out with our limited cognitive 
apparatus. But even propositional logic, as a model of logical inference, is sub- 
ject to the same criticisms: can we really "recognize" an instance of modus 
ponens when the formulas involved have more than 21°" symbols? 

To develop a notion of direct consequence, let us begin by noting that most 
of our axioms are naturally expressed as rules; in other words, they have the 
form 

if (pi,(p2, ■■■,Vn then V' 

where (pi, . . . ,ipn,4^ are literals. The example in Section 12.21 suggests that we 
should be able to chain such rules; that is, whenever we know (pi, . . . , we 
also know -0, and can use ip to secure further knowledge. Occasionally, our 
diagrammatic axioms are not quite in rule form, with either a disjunction among 
the hypothesis or a conjunction in the conclusion. But this can be viewed as a 
notational convenience; the rule "if ipi, ip2, ■ ■ ■ , ^Pn then ip and 0" is equivalent 
to the pair of rules "if (^i, (^2, • ■ ■ , Vn then -0" and "if ipi, (p2, ■ ■ ■ , tpn then 0," 
and the rule "if ipi, ip2, ■ ■ ■ , ^Pn and either 6 or rj then ?/;" is equivalent to the 
pair of rules "if ipi, ip2, ■ ■ ■ , ^Pn and 6 then ?/;" and "if ipi, ip2, ■ ■ ■ , ^Pn and 77 then 
^." 

A moment's reflection, however, shows that we should also allow "contra- 
positive" variants of our rules. For example, consider the first Pasch axiom: 

if b is between a and c and a and c are on the same side of L, then 
a and b are on the same side of L 

^We do not, however, have a lower bound on the computational complexity of the decision 
problem associated with our particular set of axioms. 
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Certainly, if we know that b is between a and c and that a and c are on the same 
side of L, we should be allowed to infer that a and b are on the same side of L. 
But suppose we know that b is between a and c but that the conclusion fails, 
that is, a and b are not on the same side of L. Drawing a picture or imagining 
the situation in our mind's eye enables us to see, straightforwardly, that the 
second hypothesis fails, that is, a and c are not on the same side of L. In other 
words, we should include the rule 

if b is between a and c and a and b are not on the same side of L 
then a and c are not on the same side of L 

as a variant of the above. More generally, we should read the rule "if tpi , (/32 , • • ■ , V'; 
then i/)" as the disjunction 

either not ipi, or not (/32, or . . . , or not (/3„, or ip 

and infer any disjunct once we know that the others are false. This is exactly 
the notion of direct consequence that we adopt: we take the set of direct con- 
sequences of a set of diagrammatic assertions to be the set obtained by closing 
the set under the inferences just described. 

Let us spell out the details more precisely. For simplicity, we initially restrict 
our attention to propositional logic. A clause is simply a finite set of proposi- 
tional literals; think of each clause as representing the associated disjunction. 
Let S" be a set of propositional clauses and let F be a set of propositional liter- 
als. Take negation as an operation mapping literals to literals, that is, identify 
-i^p with p. We define the set of direct consequences of F under S to be the 
smallest set F' of literals that includes F and is closed under the following rule: 
if {(fix, ...,(/?„} is a clause in S and -"pi, . . . , ~"Pn-i are all in F', then ipn is in 
F'. In other words, F' is obtained by starting with the literals in F and applying 
the rule above to add literals, one at a time, until no more literals can be added. 
We adopt the understanding, however, that if F' contains an atomic formula 
and its negation, then it contains every literal; in other words, everything is a 
consequence of a contradiction. 

We now provide an alternative characterization of the set F'. Consider a 
sequent calculus formulation of intuitionistic logic [71 [53] , with sequents of the 
form n intended to denote that the set of hypotheses in 11 entails (p. Take 
the "contrapositive variants" of any clause {(^i, . . . ,(pn} to be the sequents of 
the form ■ ■ ■ ,^ipn-i} ^ again with the understanding that if A is 

atomic then -^^A is replaced by A. 

Proposition 3.1. Let S be a set of clauses, and let T,9 be a set of propositional 
literals. The following are equivalent: 

1. 9 is a direct consequence of V under S. 

2. There is an intuitionistic proof of the sequent ^ 6 from initial sequents 
that are either contrapositive variants of the clauses in S or of the form 

ijj, where is a formula in F. 
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Proof. The implication from 1 to 2 is straightforward, since adding to F' the 
result of applying our rule of inference with one of the clauses in S is equivalent 
to inferring the consequence of the implication given by a contrapositive variant 
of that clause. The fact that as soon as F' contains an atomic formula and its 
negation we take every literal to be a direct consequence follows from the fact 
that _L, and hence every formula, is an intuitionistic consequence of an atomic 
formula and its negation. 

Conversely, suppose there is an intuitionistic proof of =^ '0 from the initial 
sequents described in 2. Then by a version of cut-elimination theorem for the 
intuitionistic sequent calculus with axioms and additional rules ([71 Theorem 
2.4.5] or [S51 Section 4.5.1]), there is a proof in which every cut formula is a 
literal. Since there are no other logical connectives in the initial sequents or 
conclusion, the only other rules used are the rules for negation and the "ex 
falso" rule 11, _L rj. 

We can therefore obtain the desired conclusion by proving the following 
claim: 

Suppose c? is a proof of a sequent {^i, . . . , 0„} rj from the initial 
sequents described in 2, using only the negation rules, ex falso, and 
the cut rule restricted to literals. Then for any F" D F, 

1. if 9i, . . . ,6n are in F", then rj is in the closure of F" under S; 
and 

2. if 77 is _L and 9i, . . . , 9n-i are in F", then -i0„ is in the closure 
of F" under S. 

This can be proved by a straightforward induction on d. Suppose the the last 
inference of d is the cut rule, 

6*1, . . . ,6>n ^ g gi, . . . ,6'„,q; ^ 77 
6*1 , . . . , 6'„ ^ 77 

If 7] is not ±, applying the inductive hypothesis to the left subproof yields that 
for any F" ^ F, if 61, ... , On are in F", then a is in the closure of F" under S. 
Applying the inductive hypothesis to the right subproof and F",a yields that 
77 is in the closure of F", a under 5, and hence in the closure of F" under S, as 
required. The case where 77 is _L is similar. 

Handling the other rules is straightforward. For example, if the last inference 
of d is a left negation introduction, it is of the following form: 

^1, ■ ■ ■ , ^K-l ^ ct 
0i,...,9n-i,^a^r] 

In that case, the desired conclusions are obtained by applying the inductive 
hypothesis to the immediate subproof. □ 
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In the statement of the last proposition, instead of taking all contrapositive 
variants of the clauses in S, one can equivalently take any one contrapositive 
variant of each clause in S, if we also add the following rule of double-negation 
elimination for atomic formulas: 

n, =^ _L 
A 

This has the net effect of making -i-iA equivalent to A. But it is important to 
recognize that this is not the same as adding the law of the excluded middle, A\/ 
-lA, for atomic formulas. Indeed, this is exactly what is missing from the notion 
of a direct consequence. For example, suppose 5* has rules "if A and B then 
C" and "if A and not B then C." Then C is certainly a classical propositional 
consequence of {A} under these rules, since C follows from both B and from -^B. 
But it is not a direct consequence. This distinction is what makes the notion of 
a direct consequence well-suited to modeling the diagrammatic inferences in the 
Elements. Euclid does explicitly introduce case splits when they are needed, and 
so any inference that requires considering different diagrammatic configurations, 
in an essential way, should not count as "reading off from the diagram." These 
case splits make all the difference: the next two propositions show that, in the 
propositional setting, they mark the difference between the complexity classes 
P and NP. 

Proposition 3.2. Let T be a set of literals and let S be a set of clauses. The 
question "is 9 a direct consequence of T under S?" can be decided in time 
polynomial in the size ofT and S. 

Proof. If the encoding of F and S have length n, they contain at most n propo- 
sitional variables. Starting with the literals in F, iteratively apply the closure 
rule using clauses in S, until 9 is added, or the set becomes inconsistent, or 
no further rules can be applied. Each step of the iteration amounts to scan- 
ning through the clauses in S and matching against literals already in F' to see 
whether a new literal can be added, and can be carried out in time polynomial 
in n. At each step, at least one literal is added the set F' of consequences, so 
the process terminates in at most n + 1 steps. □ 

Proposition 3.3. Suppose one augments intuitionistic logic with the following 
rule: 

n, A^jy n, -.A^jy 
n ^ r/ 

where A is an atomic formula and 11, rj is a set of literals. Then a sequent 9 
is provable from the initial sequents described in Proposition \3.1\ if and only if 
9 is a classical consequence of T together with the clauses in S. Hence, in the 
presence of such case splits, the problem of determining whether a literal is a 
consequence of S is NP complete. 
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Proof. Since the rule for case splits is classically valid, it is clear that if => is 
provable from the initial sequents 13. li it is a classical consequence of F together 
with the clauses in 5*. 

Conversely, given 0, we can work backwards and apply case splits until at 
each node we have a sequent II ^ 9 such that for every prepositional variable p 
occurring in F and S, either p or -ip is in 11. If each such sequent is classically 
inconsistent with F and the clauses in S, we obtain a proof of 9. Otherwise, 
at least one such H describes a truth assignment which is consistent with F and 
S but makes 9 false, showing that 9 is not a classical consequence of F together 
with the clauses in S. 

To prove the final claim in the lemma, let S be any set of propositional 
clauses, and let p be a new propositional variable. Then S is satisfiable if and 
only if p is not a classical consequence of S. The claim follows from the fact 
that the satisfiability of a set of propositional clauses is NP complete. □ 

We now turn to the first-order setting. Suppose 5 is a set of clauses, where 
now a clause is a finite set of first-order literals. Interpret these as universal 
axioms; that is, a clause {fi, ...,(/?„} represents the universal closure of the 
associated disjunction. If F is a set of literals, define the set F' of direct conse- 
quences of F under 5* as before, but now using arbitrary substitution instances 
of the clauses in S. 

Focusing on E in particular, we take the direct consequences of a set of 
diagrammatic assertions, F, to be the set of direct consequences of F under the 
set of rules given in Section 13.41 Note that the language of E has no function 
symbols. Since there are a fixed number of relation symbols, given n variables 
ranging over points, lines, and circles, one can bound the number of literals 
involving these variables with a polynomial in n. The preceding propositions 
then show that our notion of direct consequence has the following desirable 
properties. 

Theorem 3.4. Every direct consequence of a set of diagrammatic assertions is 
a first-order consequence of these assertions and the diagrammatic axioms. 

Theorem 3.5. Any literal that is a classical consequence of a set of diagram- 
matic assertions and diagrammatic axioms can proved from those diagrammatic 
assertions in E. 

Theorem 3.6. Let T be a set of diagrammatic assertions involving at most n 
points, lines, and circles. Whether or not a particular literal is a direct dia- 
grammatic consequence o/F can be determined in time polynomial in n. 

Note that "polynomial-time computable" need not mean feasible in practice. 
Since "between" is a ternary relation, with ten points, for example, we have to 
keep track of a thousand potential betweenness assertions. On the other hand, 
experiments described in Section [6] suggest that even the full set of quantifier- 
free consequences can be feasibly obtained for reasonable diagrams, so that our 
system should be practically implementable as well. 
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We should also provide an account of what it means to be a direct metric 
consequence. It would be perhaps most faithful to Euclid to add a finite list of 
variants extending the list of axioms given in Section 13.51 allowing one to add 
equal segments to a segment in either order, and so on. But recognizing ab and 
ba as the same quantity, or ab + cd and cd + ab as the same quantity, should 
not need explicit justification; in general, a prover should be allowed to iden- 
tify terms up to associativity, commutativity, and symmetric transformations 
without further comment. There are very simple computational devices that 
make this easy to implement in practice [15j , and it is the kind of thing we (like 
Euclid) take for granted, and so we take these to be built into E. 

In fact, we would not be doing too much damage to Euclid if we allowed 
any metric consequence of previous metric facts to be inferred in one step. 
This, too, has an easy computational implementation. As noted above, the 
theory is just the universal fragment of the theory of linearly ordered groups. 
Decision procedures for this theory have been studied extensively, and at the 
level of complexity one finds in Euclid's proofs, even the naive "Fourier-Motzkin" 
algorithm performs quite well in practice. (See [5j for an overview of such 
methods.) 

Finally, to handle the transfer axioms, we allow the prover to assert, in 
one step, the conclusion of any single rule where the hypotheses are all direct 
diagrammatic or metric consequences of the available data, i.e. the diagrammatic 
and metric assertions in F, A. Note that almost all these axioms can be described 
by clauses where exactly one of the literals is a metric assertion. (The exception 
is the third diagram-angle transfer axiom, which characterizes the notion of a 
"right angle" by stating an equivalence between two metric assertions in the 
context of some diagrammatic information. But this could be replaced by the 
Euclidean theorem that if a line is cut by a transversal, the adjacent angles add 
up to two right angles.) Sometimes Euclid takes certain metric information to 
be so clear from the diagram that he uses it without asserting it explicitly; these 
include, for example, our diagram-angle axiom 4, which asserts that different 
descriptions of the same angle have the same magnitude. In cases like that, one 
could modify our definition of "metric consequence" so that consequences of 
the diagram like these are added to the "store" of available metric hypotheses 
automatically. 

This concludes our presentation of E. The fact that there is room to tinker 
with our notion of "direct consequence" by expanding or contracting the allow- 
able inferences should help clarify the nature of our project. In order to show, 
in Section [51 that E is sound and complete with respect to the relevant "ruler 
and compass" semantics, our one-step inferences have to be sound, and the full 
proof system has to be complete. This gives us a lot of latitude in defining the 
"one-step" inferences. The fact that soundness and completeness do so little to 
constrain our choice shows that we are trying to capture something more fine- 
grained than the entailment relation for Euclidean geometry. Rather, we are 
trying to understand Euclidean proof, which requires an understanding of the 
sorts of inferences that are taken to be basic in the Elements. So, where Euclid 
draws an immediate conclusion from the data available in a proof, it should be 
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possible to carry out that inference in one step, or at most a few steps, in our 
formal system. On the other hand, in cases where Euclid invokes a chain of 
steps to reach a conclusion, our system should not sanction that inference as 
"direct." The extent to which our system meets these constraints is the subject 
of the next section. 

Ziegler |66| has shown that the notion of validity for ruler-and-compass se- 
mantics is undecidable. (His proof shows that the set of V3V consequences of any 
finitely axiomatized fragment of the theory of real closed fields is undecidable. 
It is, however, still an open question whether the set of V3 consequences, which 
correspond to the geometric assertions that can be expressed in E, is decidable.) 
It is therefore interesting to note that, in principle, one can expand our notion 
of "direct consequence" dramatically and maintain decidability: 

Theorem 3.7. The question as to whether a given literal is a first-order con- 
sequence of a finite set of literals and the set of all our diagrammatic, metric, 
and transfer axioms is decidable. 

Proof. The problem is equivalent to determining whether a finite set F of literals 
is consistent with the diagrammatic, metric, and transfer axioms. Write T = 
n U where 11 consists of the diagrammatic literals and Q consists of the metric 
literals. By splitting on cases, we can assume without loss of generality that 
for every diagrammatic atomic formula if involving the variables occurring in 
r, either ip or -^ip is in 11. There are, moreover, only finitely many substitution 
instances of the axioms in question with the variables occurring in T. Modulo 11, 
all these axioms are equivalent to quantifier-free formulas over the metric sorts. 
We can then use a decision procedure for linear arithmetic to decide whether 
the resulting set of formulas, together with 8, is satisfiable. □ 

This means that if decidability, soundness, and completeness for ruler-and- 
compass semantics were the only constraints, we could take proofs in E to 
be nothing more than a sequence of construction steps, followed by "Q.E.D." 
(or "Q.E.F."). Due to the case splits, however, this naive algorithm runs in 
exponential time, and will be infeasible in practice. 

4 Comparison with the Elements 

In this section, we argue that E provides an adequate modeling of the proofs 
in Books I-IV of the Elements, according to the criteria presented in Section [51 
In Section 14.11 we focus on the language of the Elements, and in Section 14.21 we 
present some examples to illustrate how Euclid's proofs are represented in E. 
In Section 14.31 we explore some of the ways in which proofs in E differ from 
Euclid's, and in Section 14.41 we compare our axiomatic basis to his. Finally, 
Section [4.51 provides a few more examples of proofs, some of a technical nature, 
that will be needed in our completeness proof in Section [5] 
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4.1 Language 

We begin with a discussion of the language of the Elements. Since we have 
chosen a fairly minimal language for E, we need to fix some conventions for 
interpreting the less regimented and more expansive language in Euclid. For 
example, in the Elements, Euclid takes lines to be line segments, although pos- 
tulate 2 ( "to produce a finite straight line continuously in a straight line" ) allows 
any segment to be extended indefinitely. Distinguishing between finite segments 
and their extensions to lines makes it clear that at any given point in a proof, 
the diagrammatic information is limited to a bounded portion of the plane. But, 
otherwise, little is lost by taking entire lines to be basic objects of the formal 
system. So where Euclid writes, for example, "let a and b be points, and extend 
segment ab to c," we would write "let a and b be distinct points, let L be the 
line through a and 6, and let c be a point on L extending the segment from a 
to b." Insofar as there is a fairly straightforward translation between Euclid's 
terminology and ours, we take such differences to be relatively minor. 

Our basic diagrammatic terms include words like "on," "between," "inside," 
and "same side." It is worth noting that such words rarely occur explicitly in the 
Elements. Diagrammatic assertions are sometimes implicitly present in the re- 
sult of a construction; in the example of the last paragraph, we use "& is between 
a and c" to represent one of the outcomes of the diagrammatic construction. 
Euclid also sometimes uses the physical diagram to convey a diagrammatic as- 
sertion. For example, in the first proof in Section [STTl the diagram shows that 
point d is on ab. Diagrammatic information is also implicit in some of Euclid's 
more complicated locutions; for example, we need to analyze the Euclidean as- 
sertion "a6c is a triangle" in terms of our more basic primitives. But, overall, 
it is remarkable how little diagrammatic information needs to be asserted in 
the text. One striking exception occurs in conveying the diagrammatic notion 
of being parallel (which we model with the diagrammatic predicate "does not 
intersect"): there is no way to represent the nonintersection of two lines in a 
diagram, and so Euclid uses the term "parallel" explicitly in Propositions 27-47 
of Book I to make the assertion. 

Modeling Euclid's limited use of explicit diagrammatic assertions has been a 
central goal in the design of E. Although one is allowed to enter diagrammatic 
assertions like "a is between b and c" and "a and b are on the same side of L" 
in proofs in E, the point is that often one does not need to. For example, if the 
fact that b is between a and c is a direct consequence of diagrammatic assertions 
in the hypotheses of the theorem and previous construction steps, then, using a 
transfer axiom, one can simply assert that ab + bc — ac, without further justifi- 
cation. Thus our choice of diagrammatic primitives was designed, primarily, to 
function internally, and keep track of the information that is required to license 
construction steps and explicit metric inferences. 

(We remind you that, in contrast to Tarski's and Hilbert's axiomatizations 
of geometry, we use between(a, 6, c) to denote that b is strictly between a and 
c. This choice makes our translation, in Section [5l to a formal system based on 
Tarski's axioms slightly more complicated. On the other hand, it does seem to 



41 



correspond more closely to Euclidean practice; see the discussion in Section [231 
Interestingly, as noted in Section [6] below, it also seems to provide better per- 
formance in implementations.) 

Having discussed our choice of diagrammatic primitives, we comment briefly 
on our modeling of metric assertions. In the Heath translation of Euclid, one 
finds phrases like "the base ab is equal to the base de," "angle abc is greater 
than angle def," and "angles abc, cbd are equal to two right angles." We model 
these in our formal system with the metric assertions ab = de, /.abc > ^def, 
and Zabc+ Zcbd = right-angle + right-angle. In reasoning about such quantities, 
Euclid uses basic properties of an ordered group. For example, in the middle of 
the text of Proposition 1.13, we find: 

. . . since the angle dba is equal to the two angles dbe, eba, let the 
angle abc be added to each; therefore the angles dba, abc are equal 
to the three angles dbe, eba, abc. But the angles cbe, ebd were proved 
equal to the same three angles; and things which are equal to the 
same thing are equal to one another; therefore the angles cbe, ebd 
are also equal to the angles dba, abc. [ini p. 275] 

In our system, this sequence of assertions would be represented as follows: 

Zdba = Zdbe + Zeba 
Zdba + Zabc ~ Zdbe + Zeba + Zabc 
Zcbe -f Zebd — Zdbe + Zeba + Zabc 
Zcbe -\- Zebd — Zdba -\- Zabc 

In the example, the first assertion is a metric consequence of diagrammatic 
information, namely that the point e is in the interior of the angle dba. The 
third assertion is echoed from earlier in the proof, and the other two are obtained 
using axioms of equality. Even though Euclid does not use a symbol for addition 
or the word "sum," it is clear from the text that his usage of magnitudes "taken 
together" is modeled well by the modern notions. 

Other locutions found in Euclid can be modeled as "definitional extensions" 
of E. For example, consider the phrase "let abc be a triangle." Assuming we 
take this to mean a nondegenerate triangle, we parse this as saying that a, b, 
and c are points, and there are lines L, M , and N , such that a and b are on L 
but c is not, b and c are on M but a is not, and c and a are on N but b is not. 
Furthermore, the Euclidean phrase "let ab be produced to d" involves picking a 
point d on L extending the segment from a to b, and so on. Adequate modeling 
of Euclidean talk of triangles thus involves introducing mild forms of "syntactic 
sugar" to E. 

When it comes to areas, we have only introduced a primitive for the area of a 
triangle. Books I to IV also deal with areas of parallelograms (including squares 
and rectangles) and, in the proof of Proposition 1.35, a trapezoid. One could 
introduce a new primitive to denote the area of a convex quadrilateral (convexity 
can be defined in the language of E), with appropriate axioms. Alternatively, 
one can define the area of a convex quadrilateral abed to be the sum of the 
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areas of triangle abc and acd, and then introduce the requisite properties as 
"derived rules." Extending E to handle the area of arbitrary convex polygons 
(that is, convex polygons with an arbitrary number of sides) would require a 
more dramatic extension, but this notion never arises in the Elements. 

One can prove in E that one can pick an arbitrary point in a triangle, say, or 
in a rectangle, but these facts require proof, even though they are diagrammat- 
ically obvious. To our knowledge, however, Euclid never does this. To model 
subsequent developments in geometry, one would probably need to extend E 
with a uniform treatment of convex figures. 

There are a number of concepts found in later books of the Elements that 
we have not incorporated into E. For example. Book V introduces the notion 
of multiples and ratios; propositions in Book VI refer to arbitrary polygons; 
and Book VII, which introduces elementary number theory, refers to arbitrary 
(finite) collections of numbers. It would be interesting to extend E to model 
the Euclidean treatment of such concepts as well. 

In our formulation of E, one is allowed to carry out arguments by case splits 
on an atomic formula. Case splits in Euclid can be slightly more expressive; for 
example, knowing that angles abc and abd do not coincide, Euclid may consider 
the two cases abc < abd and abc > abd. We would model this by first splitting 
on the assertion Zabc < Zabd; then in the case Zabc -jt Zabd, we would employ a 
second case split on the predicate Zabc = Zabd, the positive instance which has 
already been ruled out. We maintain that all case arguments occurring in the 
first four books of the Elements can be obtained in this way, using a sequence of 
atomic splits to obtain an exhaustive list of possibilities (e.g. if a is a point not 
on a line L, then another point b is either on the same side of L as a, on L, or 
on the opposite side of L), some of which are ruled out immediately (implying 
_L, and hence the desired conclusion right away). Once again, mild forms of 
"syntactic sugar" would allow one to express these case splits more compactly, 
resulting in proofs in E that more closely model the ones in Euclid. 

When different diagrammatic configurations are possible, Euclid will some- 
times prove only one case. Often this case is truly "without loss of generality," 
which is to say, the other case (or cases) are entirely symmetric. In E, strictly 
speaking, we would have to repeat the proof; but one could introduce a syntac- 
tic term, "similarly," to denote such a repetition. However, as Heath points out 
repeatedly, Euclid often proves only the most difficult case of a proposition and 
omits the others, even though they may require a different argument; indeed, 
much of Proclus' commentary is devoted to supplying proofs of the additional 
cases (see, for example, the notes to Propositions 2, 7, 25, and 35 in ^6, Book 
I]). Of course, in cases like this E requires the full argument. There is no rea- 
sonable syntactic account of the phrase "left to reader," and we do not purport 
to provide one. 

4.2 Examples of proofs in E 

In this section, we provide some examples of proofs in our formal system E, 
assuming the kinds of "syntactic sugar" described in the last section. We include 
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diagrams to render the proofs intelligible, but we emphasize that they play no 
role in the formal system. To improve readability, we use both the words "Have" 
and "Hence" to introduce assertions, generally using "Have" to introduce new 
metric assertions that arc inferred from the diagram, and "Hence" to introduce 
assertions that follow from previous metric assertions. But these words play no 
role in the logical system; all that matters are the actual assertions that follow. 
For the sake of intelligibility, we also sometimes add comments, in brackets. 
Once again, these play no role in the formal proof. Since the point of this exercise 
is to demonstrate that proofs in E are faithful to the text of the Elements, we 
recommend comparing our versions with Euclid's. 

Proposition 1 of Book I requires one, "on a given straight line, to construct 
an equilateral triangle." 

Proposition I.l. 

Assume a and b are distinct points. 

Construct point c such that ah = he and he = ca. 




Proof. Let a be the circle with center a passing through b. 
Let /3 be the circle with center h passing through a. 
Let c be a point on the intersection of a and /3. 
Have ah = ac [since they are radii of a] . 
Have ha = be [since they are radii of /?]. 
Hence ah = he and he = ca. 

Q.E.F. □ 

The hypotheses tell us only that a and b are distinct points, but this is enough 
to license the construction of a and /3, by rule 2 of the construction rules for lines 
and circles. Rule 5 of diagram rules for intersections gives us the diagrammatic 
fact that a and /3 intersect. Rule 6 of the construction rules for intersection 
then allows us to pick a point of intersection. Rule 3 of the diagram-segment 
transfer axioms then allows us to conclude that the given segments are equal, 
since they are radii of the two circles. Using metric inferences (the symmetry 
of line segments and transitivity of equality) gives us that ah = hc = ca. 

Our proof does not establish, per se, that c is distinct from a and 6, and this is 
an assumption that Euclid uses freely when applying the theorem. Fortunately, 
this is an easy metric consequence. 

Auxiliary to Proposition I.l. 

Assume a and h are distinct points, ah = be, and be = ca. 
Then c^ a and e^b. 
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Proof. Suppose c = a. 

Hence a = b. 

Contradiction. 
Hence c =/: a. 
Suppose c = b. 

Hence a = b. 

Contradiction. 
Hence b. 

Q.E.D. □ 

To show that c is distinct from a, we suppose, to the contrary, that c = a. 
Then direct metric inferences give us ac = 0, ab = 0, and a = b, which is a 
contradiction. (We use the word "Contradiction" for "Hence False.") The fact 
that c and b are distinct is proved in the same way. 

A more faitliful rendering of the proposition might assume "Let a and b be 
distinct points on a line, L," and then also construct the remaining lines M and 
N of the triangle. If one uses Proposition I.l as we initially stated it, one can 
simply construct Af and afterwards. Euclid also, however, sometimes needs 
the fact that c is not on the line determined by a and b. Once again, by E's 
lights, this requires a short argument. 

Auxiliary to Proposition I.l. 

Assume a and b are distinct points, a is on L, b is on L, and ab = be and 
be = ca. Then c is not on L. 

Proof. 

Suppose c is on L. 

Suppose a is between c and b. 

Hence ca < be. Contradiction. 
Suppose e = a. 

Hence a = b. Contradiction. 
Suppose c is between a and b. 

Hence ca < ab. Contradiction. 
Suppose e = b. 

Hence a = b. Contradiction. 
Suppose b is between a and c. 

Hence ab < be. Contradiction. 
Contradiction. 

Q.E.D. □ 

If a and b are distinct points on a line, Euclid often splits implicitly or 
explicitly on cases depending on the position of a point c relative to a and 
b. Strictly speaking, the proof above could be expressed as a sequence of four 
nested case splits on atomic formulas. As noted in the previous section, we can 
take the proof above to rely on notational conventions, for readability. 

When it is easy to rule out some cases, Euclid often does not say anything at 
all, where our rules may require a line or two. The fact that Euclid doesn't say 
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anything to justify the nondegeneracy of the triangle constructed in Proposition 
I.l, where E requires some (easy but) exphcit metric considerations, is a more 
dramatic difference, and is discussed in Section There, in fact, we note that 
in the proof of Proposition 1.9, Euchd seems to need a sUght strengthening of 
our Proposition I.l, which asserts that c can be chosen on either side of the L 
through a and b. This is easily obtained using rule 8 instead of rule 6 of the 
construction rules for intersections; one only needs to take the trouble to make 
the stronger assertion. 

Proposition 2 in Book I of the Elements is surprisingly complicated given 
that it occurs so early. It is a construction, requiring one "to place at a given 
point a straight line equal to a given straight line," that is, to copy a segment 
to a given point. This time, we leave it to you to check that the assertions are 
justified by our rules and our notion of direct inference, providing some hints in 
the bracketed comments. To simplify the exposition, we appeal to a version of 
Proposition I.l with the additional distinctness claim. 

Proposition 1.2. 

Assume L is a line, b and c are distinct points on L, and a is a point distinct 
from b and c. 

Construct point f such that af — be. 




Proof. By Proposition I.l applied to a and 6, let d be a point such that d is 

distinct from a and b and ab = bd and bd — da. 

Let M be the line through d and a. 

Let N be the line through d and b. 

Let a be the circle with center 6 passing through c. 

Let g be the point of intersection of N and a extending the segment from d to 

b. _ _ _ 

Have dg = db + bg. 

Hence dg — da + bg [since da = db] . 

Hence da < dg. 

Let P be the circle with center d passing through g. 

Hence a is inside (3 [since d is the center and da < dg]. 

Let / be the intersection of f3 and M extending the segment from d to a. 

Have df = da + af . 

Have df = dg [since they are both radii of /3] . 
Hence da + af = da + bg. 
Hence af — bg. 
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Have bg = be [since they are both radii of a]. 

Hence af = be. 

Q.E.F. 



□ 



Notice that the last construction step requires knowing that a is inside /3. 
We obtain this, in our proof, using simple metric considerations. We discuss 
this fact in the next section. 

Let us consider one more example. You may wish to compare the following 
rendering of Proposition 1. 10 to the one given in Section 12.11 Once again, 
to simplify the exposition, we appeal to a version of Proposition I.l with the 
additional noncoUinearity claim. The proof also appeals to Proposition 1.9, 
which asserts that an angle acb can be bisected. We take this to be the assertion 
that there is a point e such that Zace = Z6ce; with the further property that 
if M is the line through c and a, and N is the line through c and b, then e 
and b are on the same side of M , and e and a are on the same side of N. The 
last requirement could be expressed more naturally with the words "e is inside 
the angle acb," though that locution does not make M and N explicit. This 
requirement rules out choices of e on the other side of c which satisfy the same 
metric conditions. 

Proposition 1. 10. 

Assume a and b are distinet points on a line L. 

Construet a point d sueh that d is between a and b and ad — db. 



Proof. By Proposition I.l applied to a and b, let c be a point such that ab = be 
and be — ca and c is not on L. 
Let M be the line through c and a. 
Let N be the line through c and b. 

By Proposition L9 applied to a, c, 6, Af , and iV, let e be a point such that 
Zace = /-bee, b and e are on the same side of M, and a and e are on the same 
side of N . 

Let K be the line through c and e. 
Let d be the intersection of K and L. 
Have Zace = Zacd. 
Have Z6ce = Zbcd. 

By Proposition 1.4 applied to a, c, d, b, e, and d have ad = bd. 




e 



Q.E.F. 



□ 
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Figure 8: Two cases for Proposition 1.9 considered in E. 



As noted in Section [2. li when applying Proposition 1.9, Euclid immediately 
takes d to be the point of intersection; we need to bisect the angle and then 
choose the intersection explicitly. A direct diagrammatic inference yields the 
fact that the two lines intersect: the triple incidence axioms imply that points a 
and b are on opposite sides of K, which serves as the hypothesis to intersection 
rule 1. We also need to note that the angles acd and bed are then the same 
as angles ace and bee, which is justified by metric rule 6. The fact that d is 
between a and b is again the result of a direct diagrammatic inference, using 
Pasch inference 4. 

There are some cases where the extent to which formal proofs in E match 
Euclid's is particularly impressive. For example. Proposition 1 of Book III is 
"to find the center of a given circle." This may seem strange, since Euclid's 
definitions seem to suggest that every circle comes "equipped" with its center^ 
but the proposition makes it clear that we can be "given" a circle on its own. The 
fact that we use a relation symbol rather than a function symbol to pick out the 
center of a circle makes our formalization of Proposition III.l as 3a .center(a, 7) 
perfectly natural, and the proof is essentially Euclid's. 

For another example. Proposition 2 of Book III shows that circles are convex 
— more precisely, that the chord of a circle lies inside the circle. This, too, is 
somewhat surprising, since that fact seems to be as obvious as anything one is 
allowed to "read off" from a diagram. But in E, one needs a proof using metric 
considerations, as in Euclid. Thus E can help "explain" some puzzling features 
of the Elements. 

4.3 Departures from the Elements 

In this section, we discuss some instances where proofs in the Elements do 
not accord as well with the rules of E. Perhaps unsurprisingly, the most com- 
mon type of departure involves cases where Euclid's arguments are not detailed 
enough, by the standards of E. Among these cases, two situations are typical: 
first, Euclid is sometimes content to consider only one case when E demands 
a case analysis, and, second, Euclid sometimes reads directly from the diagram 
a geometric relation which in E must be licensed by a transfer rule. We will 
consider examples of each, in turn. 

^We are grateful to Henry Mendell for pointing this out. 
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As pointed out in Section [3T2l Euclid occasionally reasons by cases to estab- 
lish a proposition. When Euclid carries out such a case analysis, E typically 
provides a natural account of the proof. But when E demands a case analysis, 
Euclid does not always provide one. For an example, consider Euclid's proof of 
Proposition 9 in book I. The proposition is a problem which demands the con- 
struction of an angle bisector (see Figure [8]). After constructing equal segments 
ad and ae on the two sides of the given angle (with vertex a), Euclid joins d and 
e and constructs on the segment the equilateral triangle dfe. The vertex / of the 
triangle is then joined with the vertex a of the angle, and it is then argued that 
this segment bisects the angle. Euclid takes it as given that the point / falls 
within the angle. In E, however, one cannot. Though one may stipulate that 
/ falls on the side of the segment de opposite the point a, one cannot assume 
anything about a's position with respect to the sides of the angle. One must 
consider the cases where / falls on or outside the angle, and show that they are 
impossible!! 

Another place where Euclid falls short of meeting E's standards for case 
analysis is Proposition 1.35. Whereas with Proposition 1.9 the need for a case 
analysis arises within the construction, with Proposition 1.35 one must start the 
proof with a case analysis (see Figure [9]). Euclid's statement of the proposition 
is too general for the proof which follows. The proposition underlies the familiar 
formula that the area of a parallelogram is the product of its base and height. 
It asserts, specifically, that two parallelograms which have the same base and 
are bounded by the same parallel lines have the same area. The proof in the 
Elements, however, establishes a weaker result, in which the parallelograms 
satisfy another condition: the nonintersection of the sides opposite the common 
base of the parallelograms. Euclid groups together into one case the different 
ways the sides opposite the base can relate to one another positionally. But the 
containment relations which license Euclid's steps in his proof do not generalize 
to the other cases, which really require separate proofs. 

Proclus, in fact, commented on Euclid's cavalier attitude toward cases in 

^Vaughan Pratt has pointed out to us the contrapositive of Proposition 7 shows that if 
ad is equal to ae, df is equal to ef, and d and e are distinct, then d and e cannot lie on the 
same side of af. This immediately rules out two of the cases. But Euclid typically carries 
out an explicit reductio when he needs the contrapositive form of a prior proposition. Thus, 
if that is the proof one has in mind, E requires one to do the case split and apply Proposition 
7 explicitly. 
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Propositions 1.9 and 1.35, and furnished proofs for some of the cases Eudid 
neglected. Thus E is better understood as a codification of the more criti- 
cal attitude towards cases found in Proclus's commentary. It is an interesting 
question as to why Euclid is less rigorous in cases like these. One possible ex- 
planation is given by Heath's observation that Euclid only worries about the 
most difficult case. Another, which would apply to 1.9 but not 1.35, is that the 
norms governing the physical construction of diagrams automatically rules out 
certain possibilities for Euchdl^ 

As with E's rules for case analysis, its transfer rules can be understood as 
the articulation of standards observed intermittently in the Elements. In some 
constructions, the possibility of a certain step depends on metric facts assumed 
of the configuration. On such occasions, E requires that a metric-to-diagram 
rule be invoked. Euclid sometimes recognizes the need for such justifications, 
and sometimes does not. 

One place where he does not is in Proposition 2 of Book I. In terms of the E 
proof given in Section [4.21 Euclid does not provide any argument that the point 
a has to lie within the circle f3. The diagrammatic information in the proof 
regarding a with respect to /3, however, does not alone imply it. The metric 
fact that da < dg must be added to the proof for the position of a inside /? to 
be forced. The E proof of Proposition 2 thus contains a few lines not present 
in Euclid's proof. 

Euclid does explicitly state one metric-to-diagram rule: the famous parallel 
postulate. The postulate allows Euclid to speak of an intersection point between 
two lines — a diagrammatic piece of data — given metric data about a configu- 
ration in which the lines are embedded. Accordingly, in Propositions 1.44 and 
11.10 Euclid invokes it to justify the introduction of certain intersection points. 
Strangely, however, a similar justification is needed for intersection points ap- 
pearing in Euclid's proofs of Propositions 1.42 and 1.45, but Euclid does not 
provide it. He simply takes the intersection points to exist without mentioning 
the parallel postulate. The reasons for this inconsistency are not immediately 
apparent. The arguments which are lacking in 1.42 and 1.45 are more compli- 
cated than those included in 1.44 and 11.10. Perhaps Euclid did not want to 
complicate his exposition, or perhaps it was just an oversight. In any case, in 
E, one must invoke the parallel postulate in the proofs of all four propositions. 

We close this section with a discussion of another interesting difference be- 
tween E and Euclid. This time, it is an instance where, by i?'s lights, Euclid 
does too much. At issue are the identity conditions of circles. Euclid's definition 
reads as follows: 

A circle is a plane figure contained by one line such that all the 

^Such norms would enforce what Manders terms diagram discipline. The idea is as follows. 
Though physical rulers and compasses cannot produce perfectly straight lines and circles, a 
geometer trained in diagram discipline can be trusted to produce approximately straight lines 
and circles in his diagrams. For / to lie on or outside the angle dae in 1.9, however, one or 
more of the circles used in the construction of / would have to be dramatically non-circular. 
Euclid would thus be justified in disregarding the case as a possibility. See [321 section 3.1, 
p. 131], and also the discussion of case branching in 1311 Section 1.4, p. 95]. 
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straight lines falling upon it from one point among those lying within 
the figure equal one another; and the point is called the center of 
the circle. [TCI pp. 153-154] 

In E this definition translates into diagram-segment transfer Rules 2, 3, and 4. 
The function of the Rule 2 is to fix the construction of a circle from a given 
length as unique. In fixing it as a rule in we take it to express Euclid's 
definition directly. Euclid, however, feels that it is at least conceivable that 
two distinct circles with equal radii be constructed from the same center, for in 
Proposition III. 5 he proves that such a configuration is impossible. From this 
result Rule 2 then follows immediately. 

Thus, with Proposition III. 5 Euclid requires a proof for something which one 
can assume without proof in E. There is nothing, however, about the general 
structure of E which forces this difference; we could have replaced our Rule 2 
with a rule that licenses the key diagrammatic inference in Euclid's proof of 
III. 5. Such a rule, however, would be complicated, and rather than assume it 
we have decided to treat circles as uniquely defined by a center and a length. 
Instead, our Rule 2 conforms better to the modern conception of a circle as the 
set of points which lie a fixed distance from a given center. 

4.4 Euclid's postulates and common notions 

Since the Elements is presented as an axiomatic development, it it is worth 
considering Euclid's postulates and common notions, to see how they line up 
with the fundamental rules of E. In the Heath translation [161 P- 154-155], the 
postulates are as follows: 

1. To draw a straight line from any point to any point. 

2. To produce a finite straight line continuously in a straight line. 

3. To describe a circle with any centre and distance. 

4. That all right angles are equal to one another. 

5. [The parallel postulate; see Section [3?5l ] 

Postulates 1 and 3 are the construction rules of E for lines and circles. Postulate 
2 does not have a direct translation in our system, given that we take all our 
lines to be "indefinitely extended" ; but since Euclid will use this, say, to extend 
a segment ah to a point c, it essentially corresponds to construction 4 for points. 
Our remaining construction rules let us choose "arbitrary points" or label points 
of intersection. Euclid doesn't say anything more about this; he just does it. 
As noted in Section 13. 6[ Euclid's Postulate 4 essentially corresponds to our 
diagram-angle transfer axiom 3. Similarly, Postulate 5 is our diagram-angle 
transfer axiom 5. 

Euclid's common notions are as follows [THl p. 155]: 

1. Things which are equal to the same thing are also equal to one another. 



51 



2. If equals be added to equals, the remainders are equal. 

3. If equals be subtracted from equals, the remainders are equal. 

4. Things which coincide with one another are equal to one another. 

5. The whole is greater than the part. 

These, for the most part, govern magnitudes; in our formulation, they are there- 
fore subsumed by the laws that govern the metric sorts, together with the trans- 
fer axioms that relate the diagrammatic notions of "adding," "subtracting," and 
"being a part of" to the operations on magnitudes. For example, common no- 
tions 1 and 2 are equality rules, and common notion 3 is the cancellation axiom, 
modulo what it means to combine magnitudes in diagrammatic terms. Our 
first diagram-segment transfer axiom explains what it means to add adjacent 
segments; our second diagram-angle transfer axiom explains what it means to 
add adjacent angles; our second diagram-area transfer axiom explains what it 
means to combine the areas of adjacent triangles. In each case, one can take the 
diagrammatic configurations representing the component magnitudes to be the 
"parts" of the diagram configurations representing the sum. In that case, the 
last common notion, 5, corresponds to the fact that nontrivial segments, angles, 
and areas are positive, as given by the corresponding transfer axioms. 

Thus, Euclid's postulates correspond to some of our construction rules and 
transfer inferences, and the common notions correspond to metric inferences and 
other transfer inferences. The remainder of our construction rules, and all our 
diagram inferences, are then subsumed under what Euclid takes to be implicit 
in the definitions and the meanings of the undefined terms. It is, perhaps, 
regrettable that there is not a cleaner mapping from our axioms to Euclid's. 
But, as the discussion above indicates, even a simple principle like "the whole is 
greater than the part" assumes an understanding of how wholes and parts can 
be recognized in a diagram, and it is this implicit understanding that we have 
tried to spell out with the rules of E. 

4.5 Additional proofs 

In this section, we provide three additional theorems of E, which are needed 

for the completeness proof in the next section. The first is Euclid's Proposition 
1.12. Here, the phrase "M is perpendicular to L" masks implicit references to 
points p, d, a such that p is on M, d is on both M and L, a is on L, and angle 
pda is a right angle. 

Proposition 1.12. 

Assume point p is not on line L. 

Construct a line M through p which is perpendicular to L. 
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M 



q 



Proof. Let <; be a point on the opposite side of L from p. 

Let a be the circle through q with center p. 

Let a and b be the points of intersection of L and a. 

By Proposition 1. 10, let d bisect segment ab. 

Let M be the line through p and d. 

By Proposition L8 applied to triangles pda and pdb, we have /.pda = Zpdb. 
Hence Zpda is a right angle. 

Q.E.F. □ 

The proof is almost identical to Euclid's. Notice that it is the fourth diagram 
intersection rule that licenses the assertion that L and a intersect. 

The next two propositions are of a purely technical nature. The first shows 
how a construction in E can depend on a case split (see footnote |4|). Once again, 
we have taken some liberties with the wording. Reference to the "line through 
p and s," for example, masks a reference to a variable for a line on which p and 
s both lie. 

Technical Proposition 1. 

Assume p ^ q are on the same side of line L. 
Construct points r, s,t such that 

1. s, t are on L, 

2. r is the intersection of the line through p and s and the line through q and 
t. 





M 


N 




p 




q 


p 


L 




s = 


f 




t = e 




a 



Proof. By Proposition L12, let M be a line through p perpendicular to L, in- 
tersecting L 'At e. 

By Proposition 1.12, let N be a line through q perpendicular to L, intersecting 
L at /. 
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Suppose e ^ /. 

Hence M and N are parallel. 
Let s = f. 
Let t = e. 

Let O be the line through p and s. 

Let P be the line through q and i. 

Let r be the intersection of O and P. 

Then r, s,t satisfy 1 and 2. 
Suppose e — f. 

Let s be a point on L distinct from e. 

Let t be a point on L extending the segment from s to e. 

Let O be the line through p and s. 

Let P be the line through q and t. 

Let r be the intersection of O and P. 

Then r, s, t satisfy 1 and 2. 
Q.E.F. □ 

In the first case, a diagram inference tells us that p and t are on the same 
side of M (since otherwise TV and M would intersect). A triple-incidence rule, 
applied to L, M, and N then tells us that q and t are on opposite sides of 
O, which licenses the fact that O and P intersect. The second case actually 
requires a case distinction on the position of p and q along the perpendicular, 
at which point, the Pasch rules provide enough information to license the fact 
that O and P intersect. 

Technical Proposition 2. 

Assume line L and points p, q, r, s, t satisfy the conclusions of the previous propo- 
sition. 

Then p and q are on the same side of L. 

In fact, this is a direct diagrammatic inference, using the Pasch rules. 

5 Completeness 

In this section, we sketch a proof that E is complete for a modern semantics 
appropriate to the Elements. This semantics is presented in Section 15.11 and 
the completeness proof is presented in Sections I5.2H5.4I 

5.1 The semantics of ruler-and-compass constructions 

Thanks to Descartes, Euclid's points, lines, and circles can be interpreted, in 
modern terms, as points, lines, and circles of the Euclidean plane, R x R. It 
is straightforward to show that all the constructions and inference rules of E 
are valid for this semantics. E is not, however, complete for this semantics: 
all of Euclid's constructions, and hence all constructions of E, can be carried 
out with a ruler and compass, and Galois theory tells us that no ruler-and- 
compass construction can trisect a sixty degree angle [23, p. 240]. In particular. 
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E cannot prove that there exists an equilateral triangle and a trisection of one 
of its angles. The negation of this statement is a universal statement, and so 
can also be expressed in E. This shows that there is an existential statement 
that can neither be proved nor refuted in E, showing that E is not syntactically 
complete, either. 

Fortunately, there is a better semantics for the Elements. An ordered field 
is said to be Euclidean if every nonnegative element has a square root. Taking 
square roots essentially allows one to construct the intersection of a line and a 
circle, and conversely. Say that a sequent of E is valid for ruler and compass 
constructions if its universal closure is true in every plane F x F, where is a 
Euclidean field, under the usual cartesian interpretation of the primitives of E. 
Our goal in this section is to outline a proof of the following: 

Theorem 5.1. A sequent T 3x. A is valid for ruler- and- compass construc- 
tions if and only if it is provable in E . 

Once again, the "if" direction, asserting that E is sound for rulcr-and- 
compass constructions, is straightforward. We will therefore focus on establish- 
ing completeness. A direct proof would involve assuming that a given sequent is 
not provable in E, and then constructing a Euclidean field in which that sequent 
is false. But given _E"s restricted logic, the details would be tricky, and our job 
will be much easier if we build on previous work. Tarski 57] gave a sound and 
complete axiomatization not only of the full Euclidean plane, but also of the 
fragment that is valid for ruler- and-compass constructions. It is therefore suffi- 
cient to show that E is complete with respect to Tarski's axiomatization of the 
latter. 

There are, however, obstacles to this approach. For one thing, Tarski's ax- 
iomatization of geometry uses only one sort, namely points, and two primitives, 
for betweenness and equidistance, as described below. So interpreting state- 
ments of E in Tarski's system and vice-versa involves a change of language. A 
more serious obstacle is that Tarski uses full first-order logic, in contrast to the 
very meager fragment that is allowed in E. So knowing that a statement is 
provable in Tarski's system is not a priori helpful, since there will generally be 
no line-by-line interpretation of this proof in E. 

Below, however, we will show that with a modicum of tinkering, Tarski's 
axioms can be expressed in a restricted form, namely, as a system of geometric 
rules. We will then invoke a cut elimination theorem, due to Sara Negri, that 
shows that if a sequent of suitably restricted complexity is provable in the sys- 
tem, there is a proof in which every intermediate sequent is also of restricted 
complexity. This will allow us to translate proofs in Tarski's system to proofs 
in E. 

More precisely, we will craft a slight variant, T , of Tarski's system, which is 
sound and complete for ruler-and-compass constructions, and enjoys some nice 
proof-theoretic properties. We will define a translation tt from sequents of E to 
sequents of T", and a re-translation p in the other direction. Ultimately, we will 
show that the systems and translations involved have the following properties: 
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1. If r =^ 3x. A is valid for ruler and compass constructions, then T proves 
7r(r ^ 3x. A). 

2. If T proves 7r(r 3x. A), then E proves /o(7r(r ^ 3f. A)). 

3. If E proves p{n{r ^ 3x. A)), then E proves T ^ 3x. A. 

This yields the desired completeness result. Since many of the details are 
straightforward, we will be somewhat sketchy; additional information can be 
found in Dean's MS thesis [H] . 

In fact, we will not interpret the area ("A") function of E or the functions 
and relations on the area sort; so we only establish completeness for theorems 
that do not involve areas. Defining an adequate notion of area in Tarski's system 
requires a fair amount of work, although by now the mechanisms for doing so are 
well understood (see, for example, Hilbert [121 Chapter IV]). We are confident 
that the methods described here extend straightforwardly to cover areas as well, 
but spelling out the details would require more effort. 

5.2 Tarski's system 

Tarski's axiomatization of the ruler-and-compass fragment of Euclidean geom- 
etry employs the language, C, whose only nonlogical predicates are a ternary 
predicate, B, where B{abc) is intended to denote that a, h, and c are coUinear 
and b is between a and c; and a four-place relation, =, where ab = cd is in- 
tended to denote that segment ab is congruent to segment cd. (In contrast to 
the "between" predicate of E, Tarski's B denotes nonstrict betweenness.) The 
axioms consist of (the universal closures of) the following (see, e.g. [58]): 

1. Equidistance axiom (El): ab = ba 

2. Equidistance axiom (E2): (ab = pq) A {ab = rs) (pq = rs) 

3. Equidistance axiom (E3): (ab = cc) —t a = b 

4. Betweenness axiom (B): B{abd) A B{bcd) — > B(abc) 

5. Segment Construction Axiom (SC): 3x (B{qax) A {ax = be)) 

6. Five-Segment Axiom (5S): 

[-i(a = 5) A B{abc) A B{pqr) A {ab = pq) A {be = qr)A 
{ad = ps) A {bd = qs)] {ed = rs) 

7. Pasch Axiom (P): B{apc) A B{qeb) 3x {B{axq) A B{bpx)) 

8. Lower 2-Dimension Axiom (2L): 3a, b, c [^B{abe) A -^B{bea) A -^B{eab)] 

9. Upper 2-Dimension Axiom (2U): -i(a = b)A/\'^^^ Xia = Xib — > {B{xiX2X^)\/ 

B{x2X3Xi) V B{x3XiX2)) 
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10. Parallel Postulate (PP): B{adt) A B{bdc) A ^(a = d) ^ 3x,y {B{abx) A 
B{acy) A B{ytx)) 

11. Intersection Axiom (Int): {ax = ax') A {az = az') A B{axz) A B{xyz) —>■ 
3y' {{ay = ay') A B{x'y'z')) 

Intuitively, the last axiom says that any line through a point lying inside a circle 
intersects the circle. Tarski showed that when one replaces this axiom with the 
Continuity Axiom Scheme, 

3a Va;, y {'p{x) A ip{y) B{axy)) 3b \fx, y {ip{x) A ip{y) ^ B{xby)) 

the result is complete for the semantics of the full Euclidean plane. But he also 
showed that axioms 1-11 are complete for ruler-and-compass constructions, and 
it is this result that is important for our purposes 

Theorem 5.2 (Tarski). If ip is valid for ruler-and-compass constructions, then 
ip is a first-order consequence of the axioms above. 

We will now fashion a variant of this system with better proof-theoretic 
properties. A theory is called geometric if all of its axioms are sentences of the 
following form: 



where the A^s and B^s are atomic formulas (including T and _L), and each of x, 
y or the antecedent of the conditional could be empty. Formulas of the form (★) 
are called geometric. Those geometric formulas with only a single disjunct in 
the consequent (i.e. geometric formulas in which V does not appear) are called 
regular. Note that, on our modeling, Euclid's propositions are almost of this 
latter form, the difference being that arbitrary literals (negated atomic formulas 
as well as atomic formulas) are allowed in the antecedent and consequent. 

Sara Negri [l^i building on earlier joint work with Jan von Plato 43J, has 
established a cut-elimination theorem for geometric theories that we can put to 
use in our completeness proof. Suppose we have a geometric theory formulated 
in a standard two-sided sequent calculus (see, for example [71[5n])- Then the 
theory can be recast equivalently by replacing each of its geometric axioms 
like the one above with a corresponding inference rule, called a geometric rule 
scheme (GRS): 

^"Note that the system for ruler-and-compass constructions is finitely axiomatized, in con- 
trast to the stronger system with the Continuity Axiom Scheme. Ziegler [66J proved that any 
finitely axiomatizable theory of fields that has among its models an algebraically closed field, 
a real closed field or a field of p-adic numbers, is an undecidable theory. It is clear from the 
present result that the formal system for ruler-and-compass constructions has a real closed 
field among its models (since a real closed field is, a fortiori, Euclidean). Thus the system is 
undecidable. 
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Here we assume that the variables among the j/j's do not appear free in B, H or 
Negri's principal result is the following theorem, whose corollary wc will 
apply later. 

Theorem 5.3. Any sequent provable in a sequent calculus with geometric rule 
schemes has a cut-free proof. 

Since the cut rule is the only rule that removes formulas, this shows that if a 
sequent 11 is provable in such a system, there is a proof that mentions only 
subformulas of formulas in 11 and Q, and possibly some other atomic formulas. 

Say a sequent 11 8 is geometric if 11 is a set of atomic formulas and is 
a finite set of existentially quantified conjunctions of atomic formulas. In other 
words, a geometric sequent is a representation of a geometric formula where the 
implication is replaced by the sequent arrow and the outer universal quantifiers 
are left implicit. Say a geometric sequent is regular if Q consists of at most 
one formula. Theorem 15.31 implies that if we are working in a sequent calculus 
with geometric rule schemes, then any provable geometric sequent has a proof 
in which every sequent is geometric; and, similarly, any provable regular sequent 
has a proof in which every sequent is regular. 

Tarski's axiomatization for the ruler-and-compass constructions is nearly 
geometric. The only stumbling block is that in (★) the conjunctions are required 
to be conjunctions of atomic formulas, not literals. Thus, for instance, the lower 
2-dimensional axiom 

3a, b, c {^B{abc) A -^B{bca) A ^B{cab)) 

is not geometric. We remedy this situation by introducing explicit predicates 
for the negations of = and B and =; that is, we expand our language to one 
called C{T) by adding predicates ^ and B and ^; and we add the (geometric) 
axioms 

• Vx,?; {{x = y)\J {x^ y)) 

• Vx, y {{x = y) A{x ^y) ^ ±) 

as well as analogous ones for B,B and =,^. We will call these "negativity 
axioms" below. Also, we replace any negated instances of = or i? (there are no 
such negated instances of =) from Tarski's original axiomatization with the new 
corresponding predicate, thus obtaining a geometrically axiomatized theory. 

Notice that there is an obvious translation from the language C{T) of T 
to the language of Tarski's system, which maps, e.g., occurrences of B{xyz) to 

^^If one represents sequents using sequences or multisets of formulas, as Negri does, the 
rules must be presented with the B{x) repeated in the premises in order for Negri to prove the 
admissibility of the structural rules of contraction and weakening, along with cut-elimination. 
Taking 11 and to be sets is notationally simpler and suffices for our purposes. 
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-iB{xyz), and so on. This translation preserves provability, since the negativity 
axioms imply that the new predicates behave like negations. We now go further 
and put the nonlogical axioms of T into the form of geometric rule schemes. 
First of all, the negativity axioms look like this: 

JNeg 



_L,n ^ e 



Neg 



and similarly for the other predicates. The remaining rules are as follows (and 

note that variables appearing in parentheses next to the rule names are those 
which are not allowed to appear free in the conclusion): 

a6 = 6a, n => 6 

■El 



{pq = rs),n ^ 6 



(ab = pq), {ab = rs), 11 © 

(a = &),n^e 



E2 



E3 



(a6 = cc),n ^ e 

B(a6c),n ^ 9 
B{abd),B{bcd),n^ 9 

B{qax), {ax = 6c), 11 => 9 



B 



SC(x) 



n=>9 

{cd = rs),U^ e 



a^b, B{abc), B{pqr), {ab = pq), {be = qr), {ad = ps), {bd = gs), 11 ^ 9 

B{axq).B{bpj:),n => 



5S 



B{apc),B{qcb),n^ 9 
'B{abc),B{bca),B{cab),Ii^ 9 



P(x) 
2L(a,b,c) 



n^9 

B{xiX2X3,),Tl^ Q B{x2X'iXi),Ti^ Q B{xzXiX2),Ii.^ Q 
a ^ b, {xia = xib), {x2a = X2b), {x^a = 0:36), 11 9 

B{abx), B{acy), B{ytx),n ^ 9 



2U 



B{adt),B{bdc),a^ d,Il=>e 



PP(x,y) 
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{ay = ay'),Bix'y'z'),U^e 

{ax = ax'), {az = az'), Biaxz), B{xyz),Il ^ Q 



Since the resulting system is just a reworking of Tarski's axiomatization, 
combining Theorem 15.21 with Negri's Theorem 15.31 yields the following: 

Lemma 5.4. Let H ^ Q be a geometric sequent in the language of T that is 
valid for ruler- and- compass constructions. Then 11 has a cut-free proof in 
T. 

5.3 Translating E to T 

Our goal now is to provide a translation tt that maps any sequent T ^ 3x. A 
of i? to a geometric (in fact, regular) sequent 11 ^ of T", with the following 
properties: 

• The translation preserves ruler-and-compass semantics, so that if F =^ 
3x. A is valid for ruler-and-compass constructions, so is 11 0. 

• Conversely, the existence of a cut-free proof of 11 => 6 in T implies the 
existence of a proof of F ^ 3x. A in i?. 

In this section we will define the translation and show that it satisfies the first 
property. The second property is then established in Section 15.41 below. 

In carrying out the translation, we will represent each line L of i? by distinct 
points cf,C2 that are assumed to lie on L. Similarly, we will represent each 
circle 7 of i? by its center, cj, and a point, C2, that is assumed to lie on 7. More 
precisely, given any sequent F 3x. A of i?, we will choose fresh variables 
cf, C2 for each line variable L occurring in the sequent, and fresh variables cJ, 
for each circle variable 7. Let A consist of the assumptions 

{c[^4,on(cf,L),on(c2^L)} 

for each line variable L among x, and the assumptions 

{center(c]',7),on(c^,7)} 

for each circle variable 7 among x. (Note that, in E, 7^ is a consequence of 
the latter set of assertions.) Let F consist of the assumptions corresponding to 
the remaining line and circle variables in the sequent. Then clearly F 3x. A 
is provable in E if and only if F, F =^ 3x, c. A, A is; and one is valid if and only 
if the other is valid as well. When we translate F 3x. A to the language of T, 
we will use these new variables, and the translations will make sense as long as 
we assume cf ^ C2 and cJ ^ €^ fo^' the relevant constants. When we translate 
back, we will add the assumptions in F, A, which will make it possible for E to 
show that the result is equivalent to the original sequent. 
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a 




To define tt, first, for eaeh i?-literal A we will define a corresponding C{T)- 
formula Tr{A) of the following form: 




where the M^'s are atomic. (Formulas of this form are sometimes referred to 
as positive primitive formulas.) We will occasionally abuse notation below and 
write TT^A) for the conjunction Mk{z) without the existential quantifiers out 
front. Furthermore, if we have a set of literals Ai, . . . , A„i and 

for each i, we will sometimes write 7t{Ai, . . . , Am) to refer to 

m rii 
1=1 fc=l 

We do so for the sake of perspicuity and simple readability. When making such 
abuses, we will call attention to the fact that we are doing so, and no confusion 
should arise. 

In each case, our translation provides a natural way of expressing the cor- 
responding literal of as a formula of the desired form, though some thought 
(and a diagram) is often needed to make sense of it. For example, the trans- 
lation of on{p, N) is illustrated by Figure [TOl For the diagrammatic assertions, 
the clauses of the translation are as follows. 

• on(p, N) ^ 3a, 6(a 7^ 6 A a = cf & A c^a = b A pa = pb). 

V ' 

. -on(p,7V) ^ B(cfc^p)A:B(cfpc^)A:B(pcfc^). 

• same-side(p, g, N) ^ 

3r, s, t, a, 6(C(cf , c^, s, a, 6)AC(cf , , t, a, 6)Ax(cf , ,r)AB{prs)AB{qrt)). 
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• -■same-side(p, g, AT) 3r, a, b{({c^ ,C2 ,r, a, b) A B{prq)). 

• between(p, q, r) i— > B{pqr) Ap^qAq^rhp^r. 



-■between (p, q, r) 



3a, 6, f,g,h,x,y,z 



x(a, h,q) /\a ^ p Aa ^ q /\a ^ r Ah ^ p Ah ^ q /\h ^ rA 

B{apx) A B{aqy) A B{arz) Ap ^ x Aq^ y Ar ^ zA 
Bibpf) A B(bqg) A B{brh) Ap^fAqj^gAr^hA 
B{xyz) A B{fgh) 



cjp. 



cv c. 



1^2- 



• oii(p,7) I- 

• -'on(p,7) 

• inside(p, 7) i-> 3a; {B{c'lpx) A p^ x A {cjx = cjc^)). 

• -■inside(p, 7) 1— *• 3x (-B(c7a;p) A (c^a; = c] C2))- 

These can be used to define equality and disequality for lines and circles: 

• L = M y-* on(cf,M) Aon(cf ,Af). 

• M 3x (on(x, L) A ^on(x, M)). 

.7 = 5 ^ cJ = 4a cjq EE 44. 

• 7 ^ 5 3a; (on(a;,7) A -•on(x, J)). 

More precisely, the translation involves expanding the 7f images of the literals 
on the right-hand side, and bringing the existential quantifiers to the front. 

We have not yet indicated the 7f-images for literals involving the intersects 
predicate. The positive literals are straightforwardly expressed in terms of lit- 
erals that have already been translated: 

• intersects(L,M) L ^ M A 3a; (on(a;, L) A on(.T, M)). 

• intersects(i,7) 1— »• 3a;, y (a; y Aon(a:, L) Aon(a:, 7) Aon(i/, L) Aon(t/, 7)). 



• intersects(7, 6) 
on{y,S)). 



7 7^ ^ A 3a;, y {x ^ y A on{x, 7) A on(x, 6) A on{y, 7) A 



The negative literals, which assert nonintersection, require something more 
roundabout. For instance, we express the fact that a and (3 do not intersect by 
saying that the line segment from the center of a to the center of /3 encounters 
a point on a strictly before a point on (3: 



iintersects(a, /?) 3p,a,b 



cfc^ = cfa A 44 = A a 7^ 6A 
B{c1ap) A B{4bp) A B{apb) 
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Appropriate positive primitive 7f-imagcs for the literals ^intersects(L, a) and 
-iintersects(L, M) can be found using 7F-images from above, as well as the trans- 
lation for Zxyz = right-angle which is given below. For instance, to say that 
-iintersects(L, a), we assert the existence of points a, b, c, where a is on a, 6 ^ c 
are on L, a is strictly between cf and b, and Zabc = right-angle. Similarly, 
-iintersects(i, M) can be expressed by asserting the existence of a, b, c, d, where 
a ^ b are on L, c ^ d arc on M , and the angles Zabc and Zbcd are right angles. 

The last type of literal to treat is that of metric assertions about segments 
and angles. Those for segments are more straightforward. Any term of the 
segment sort will be of the form pTqi + ■ • • + PkQk (we can ignore occurrences of 
0; the translation below also makes sense for "empty sums"). Two such sums 
are equal if the segments can be laid side by side along a line so that the starting 
and ending points are the same. So, under our translation. 



maps to 



Piqi H h Pkqk = UiVi H h UmVr, 



B{aoaia2), -6(010203), . . . , B(afe_20fe_iOfe), 

Bibobib2).B{bib2bs), B{bk-2bk-ibk): 

{piQi = aooi), {p2q2 = 0102), . . . , (pkqk = ak-iak), 

{uiVi = bobi), {U2V2 = 6162), • • ■ , iUmVm = 6m-l&m), 

ao = bo,ak = bm 



The translations of the other segment literals are obtained from this one with 
minor changes to the last part. Namely, the corresponding translations are 
obtained by making the following indicated changes to the last line above: 

i 3 

y^^pWt < y^^UjVj !-»■ ao = bo,ak^bm,B{bo,ak,bm) 

i 3 

y^Mi ^ y^MjW i-> ao = bQ,B{aobmak) 

i 3 

For the angle literals, a little care is needed. First, note that we can define 
equality and inequalities of angles as follows: 

• Zxyz = Zx'y'z' 

Bu, V, u' ,v' {B{xuy) A B{yvz) A B{x'u'y') A B{y'v'z') A {uy = u'y') A {yv = y'v') A{uv = u'v')). 



• -^{Zxyz = Zx'y'z') 

3u, V, u' , v'(^(x, y, z, x' ,y' ,z' , u, v, u' , v') A {uv ^ u'v')). 
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a. 




Figure 11: Here ^aiba^ = Zcidcs, but '^Si = 2n/5 while ^ = 47r/3. 



• Zxyz < Zx'y'z' i-^ 

3u, V, u' , v' , a'(^(x, y, z, x' , y' , z' ,u, v, u' , v') A a' ^ v' A B{u'a'v') A {uv = u'a')) 



• -^{/.xyz < Zx'y'z') t-^ 



We can also say that an angle is a right angle: 
• Zxyz = right-angle t— > 

3p, u,v,u',v'{xy^yAyj^zApy^yA B{pyz) A^{x,y, z,x,y,p, u, v,u' ,v') A (uv = u'v')) 

At issue is how to compare sums of angles. Suppose we have two sums "^Si^ 
^ ti of angle terms. In analogy to the segment case, we would like to take the 
various angles in two given sums, reconstruct them by "stacking them up" via a 
series of points around respective fixed vertices, and then compare the sums by 
measuring the resulting angles formed by the initial and final points. The reason 
this can fail is that such a measure does not compare the sums themselves, but 
rather whether 



so that unequal sums might be identified with one another. (See Figure [TT] for 
instance.) 

To remedy this, we do not stack the original angles. Instead, if comparing 
a fc-fold sum and an m-fold sum, we let n = max(fc,TO) and compare n-fold 
bisections of the summand angles. The point is that the resulting angles are 
guaranteed to be no greater than the greatest of the original angles: 



3u, V, u' , v' , a{^(x, y, z, x' ,y' , z' ,u, v, u' , v') A B{uav) A {ua = u'v')) 





i=l 



64 



Thus our choice of taking max(fc, m)-fold bisections means that our modified 
stacks all fit within one of the original angles from one of the sums, and E^s 
setup guarantees that the term denotes an angle less than or equal to tt. Thus 
we can make the kind of straightforward comparison of these shrunken stacks 
that we would like. 

Given that longwinded explanation, we will not spell out the translation 
of the angle literals in detail, and will only briefly indicate how one of them 
proceeds; the others result from minor modifications of it, as with other groups 
of literals above. First we want an auxiliary T-formula which says "Zp'gV = 
(l/2")Zpgr," i.e. that the former is an n-fold bisection of the latter. The 
following works: 

3a, 6, a', 6', wi, . . . , i 



B{qap), B{qbr),B{q'a'p'), B{q'b'r'), 

B{aUiU2), B{uiU2U3), -B(w„_2Mn-lWn), -B(u„_iu„6), 
{Za'q'b' = Zuiqu2), (Za'q'b' ~ Z.U2quz)^ . . . , {Za'q'b' — Zu„q6), 
Zaqui = Zuiqb 



The translation of the literal 

k m 

zxiUiZi = y^ptg^r, 

i=l 3=1 

would then use the preceding formula, along with the formula ^ from the trans- 
lations of the diagrammatic angle literals above, in order to construct a positive 
primitive formula asserting the existence of two stackings of max(fc, m)-fold bi- 
sections of the original angles which, when compared in a similar fashion as the 
segment metric assertions were, are seen to be equal. The details are tedious to 
spell out, but straightforward. 

We now extend 7f to a translation tt : C{E) £( T) that maps every sequent 
r => 3x. A of i? to a regular sequent of T. Suppose T 3a;. A is of the form 

Ai,...,Ak=^ 3x. Bi, . . .,Bm, 

where we have 

niA.O = 3z- 1^ /\ Af,,,^ , 7f(B,) = 3y, |^/\ N,,}j . 

Let A' consist of the assumption cf ^ for each line variable L among x, and 
the assumption 7^ for each circle variable 7 among x. Let F' consist of 
the corresponding assumptions for the remaining line and circle variables in the 
sequent. We define the image of this sequent, under tt, to be the regular sequent 

m / Pi \ 

F',Mi,i,...,Afi^,,,...Mfe,i,...,Mfe^,, ^3f,yi,...,y„„c /\A'a/\ f\N,A 

t=l \r=l / 



^■^So, with our abuse of notation mentioned above, we could render this simply as 

m 

r', 7f(yli), . . . ,?f(Afc) ^3x,yi,...,ym/\A' A /\ W{Bi). 
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The following lemma captures all that we need to know about tt. 

Lemma 5.5. F 3x. A is valid for ruler- and- compass constructions if and 
only i/7r(r 3x. A) is. 

Once we have crafted tt appropriately, the lemma is quite straightforward to 
prove, given a precise articulation of the cartesian interpretation of C{E) and 
C{ T) in the plane built on any Euclidean field. Given the definition of tt in terms 
of 7f , it suffices to prove the result for sequents consisting of a single literal; you 
can check that, for instance, the Technical Propositions in Section [4751 prove the 

same-side(p, g, L) case (given the soundness of E). Further details can be 
found in [H]. 

5.4 Interpreting T in E 

By Lemma 15. 5[ we know that if a sequent F ^ 3x. A in the language of E 
is valid for ruler-and-compass constructions, then so is 7r(F => 3x. A). By 
Lemma [5.41 this implies that 7r(F ^ 3x. A) has a cut-free proof in T. All that 
remains is to define a mapping p from regular sequents in the language of T to 
sequents in the language of i?, and show the following: 

• If there is a cut-free proof of 7r(F ^ 3x. A) in T, then there is a proof of 
p{-k{T ^ 3x. A)) in E. 

• If there is a proof of p{'tt{T 3x. A)) in E, there is a proof of F ^ 3x. A 
in E. 

Once again, we first define a translation p for individual atomic formulas, 
and then extend the map to sequents. (And we will make the same abuse 
of notation below regarding p as was noted for tt.) The atomic formulas are 
mapped as follows: 

B{pqr) (3i, a, h).[a ^ h,a ^ p,a ^ q,a ^ r^h ^ p,b ^ q^h ^ r, 

on(a, L), on(6, i), on(p, i), on(g, i), on(r, i), between(a, g, 5), 
-ibetween(a, q,p), -ibetween(p, a, g), -ibetween(g, 6, r), 
-ibetween(r, &)] 

B{pqr) -ibetween(p, q,r),p ^ q,q ^ r 

p=q ^ p^q 

p^q ^ jip ) 

xy = vu ^ xy = vu 

xy ^ vu I— > xy ^ vu 

Why the first two are appropriate should be clear upon refiection (remem- 
bering that between(p, q, r) is meant to be strict, while B{pqr) is not), and the 
others are obvious. 

We now extend the map to sequents 

Pi(af),...,P„(f)^3y [f\Q,{x,y)\. 
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Assuming each Pi{x) is mapped to 3zi. Mi{x, Zi) by p, where each Mi is a set of 
Uterals, and assuming each Qj{x, y) is mapped to 3wi. Nj{x, y, Zj), the sequent 
above is mapped to the sequent 



Mi(f, zi), . . . ,Mfe(f, Zfc) 3y,wi,...,wi. Ni{x,y,zi),...,Ni{x,y,zi) 



We now proceed to estabhsh the two properties indicated above. The next 
lemma estabhshes the first. 

Lemma 5.6. // there is a cut-free proof of the regular sequent 



in T , then there is a cut-free proof of its p translation, 

Mi{x, zi), . . . , Mfc(f, Zk) 3y, wi,..., wi. Ni{x, y, zi), . . . , Ni{x, y, zi), 
in E. 

Proof. We proceed by induction on the proof in T . We need to show that 
every inference of T is mirrored by a proof in E. The logical axioms and the 
logical rules which can appear in a cut-free proof of a regular sequent are already 
incorporated into the machinery of E: 

• (Left/right conjunction rules). We note that we do not have the symbol 
A in the language of E\ instances of it get unpacked via the translation p. 
The left rules becomes vacuous, and the right rule is easily checked to be 
a derived rule of E (as an instance of theorem application). 

• (Right exists rule) . Similarly, uses of this rule disappear in the translation. 

• (Left falsum rules). The effects of these rules are subsumed under i?'s 
notion of direct consequence. 

• (Negativity axioms). Similarly straightforward. 

We are left with the remaining GRS's from Section [5T^ With one exception, 
these are of the form 




Ai,...,A„,n^e 



Bi,...,s„,n^e 



13 



Again, with abuse of notation this is just 



p(Pl), . . ■,p(Pn) =^ 3y,wi, . . .,wi.p{Qi), . . .,piQi). 
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which is to say, they correspond to the Tarskian axioms which are regular. In 
these cases, it suffices by the induction hypothesis to show that E proves 

. . .,p{B^) ^ 3x.p{Ai), . . .,piA„). 

Note that we are using the abuse of notation described in the last section. 
Checking the details of this for the various regular GRS's is pretty painless. For 
instance: 

• (E1,E2,E3). Given the trivial nature of p for = statements, it is easy to 
see that these cases are handled by our metric rules. 

• (2L). Let a be a point. Construct a point b ^ a. Construct line L 
through a, b. Construct a point c that is not on L. Each of between(a, b, c) 
or between(6, a, c) or between(a, c, b) leads to on(c, L), hence a contradic- 
tion. Thus in E we can conclude -ibetween for each. One can check the 
definitions of 2L and p to see that we have done what is needed. 

• (SC). The Technical Propositions in Section [4.51 provide the needed E 
constructions here. 

• We omit the remaining cases, some of which are slightly more involved, 
but none of which are interesting or enlightening. 

All that remains is the sole GRS which is not regular, the upper two-dimensional 
axiom. The situation is not really all that different from the regular cases; what 
we have to show, given the inductive hypothesis, is only slightly different. 

The following suffices. Suppose we have a =/= b, and xja ~ Xib for i = 1, 2, 3. 
We need E to prove that two instances of -ibetween(xi, Xj,Xk) hold. We reason 
by cases; d la Euclid we present only the case in which all the Xi are distinct, 
as the other cases are only easier. 

For each i, construct circle with center Xi, passing through b. Construct 
line L through a, b. By Proposition 1.12 (formalized in E above), construct line 
M perpendicular to L. It is then a direct consequence that each Xi is on M . 

Once again, we reason by cases, considering each parity for each possible 
hetween{xi, Xj , Xk)', there are eight cases (omitting symmetry in the between 
arguments). In the four for which two positive between relations were to hold, E 
derives a contradiction. In the other four cases, we have two negative instances, 
which is what we needed. □ 

Given the previous lemma, we are almost home. We have shown that if 
r 3x. A is a valid sequent of E, then there is a cut-free proof of 7r(r ^ 3x. A) 
in T, and hence a proof of p{n(r 3x. A)) in E. The trouble, of course, is 
that /9(7r(r ^ 3x. A)) is not quite the same thing as F ^ 3a:. A. For one thing, 
the lines and circles in the original sequent have been replaced by pairs of points 
representing them; and the translated sequent will typically feature extra points 
and hypotheses in both the antecedent and consequent. The next two lemmas 
demonstrate that, from the E proof of the translated proposition, we can in fact 
recover a proof of the original proposition, F 3x. A. 
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Lemma 5.7. Let M{x) be any literal of E. Suppose that 

771 

7f(M) = 3£/\g,(f,f), 

and further that 

p{Qj) = ^yj-Aj,i, Aj,nj ■ 
Let 6 consist of the assumptions 

{cf ^c|',on(cf,i),on(c^,i)} 

for each line variable L in M, and the assumptions 

{center(c7,7),on(c^,7)} 

for each circle variable j in M. Then E proves both 

(1) 0, M ^ 3z,y-i_, . . . ,ym-Ai^i, . . . ,Ai 

(2) e,>li,i,...,^i,„i,...,>l„,i,...,A„,,„„ ^ 3x. M, 

where x are the line and circle variables in M. Moreover, E proves all sequents 
of the form 

t{i^t\^ 3L. on(c{',L),on(c^,L), 

and 

7^ =4- 37. center(c7,7),on(c2,7). 

Before getting to the proof, we note that clause (1) of the lemma just says 
that E proves Q. AI => 'p{Tf{M)) for any htcral. Moreover, with our abuse of 
notation we can render the second part more perspicuously as asserting that E 
proves e,p(7f(M)) =^ M. 

Proof. The last two claims in the lemma are immediate, using the construction 
rules of E. For the first two claims, in order to avoid needless tedium, we 
indicate details for only a few cases (and also indicate how trivial some of the 
cases are). 

• (between(p, q, r)). We need to show that between(p, q, r) is inter-derivable 
with 

3L.on{p, L),on{q, L), on(r, L), -ibetween(p, r, q), -^hetweeu{q,p, r), 

P¥'<l,<l¥=r,pj^r. 

Supposing the latter, we can conclude between(p, q, r) from the sixth be- 
tweenness rule. 

For the converse, suppose between (p, q,r). A couple of applications of our 
first bctweenness rule yield -ibetween(g,p, r), ^between(p, r, g) and the 
distinctness assertions. Construct line L through p, q; r is on L as well, 
by the sixth and second betweenness rules. 
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• (on(p, 7) or ^011(73,7)). This is immediate from the diagram-segment 
transfer axioms. 

• {xy = 'zw or lEy ^ 'zw) . Similarly easy. 

• {xy < 'zw) . In this case we need to show that the literal is inter-derivable 
with 

Ela, L.on(z, L), on(a, L), on(u;, L), a ^ w, z ^ w, 

^between(a, z, w), -ibetween(z, w, a),xy — 'za. 

Suppose the latter. In case z ^ a, it follows that between(z, a, w) (be- 
tweenness rule 6). Then 'za + mv = 'zw (diagram-segment rule 1). As 
a ^ w, aw > (first metric inference). By our linear arithmetic, then, 
'zw > xy as desired. In the case z = a, we have xy = 'za = and Tw ~ Hw. 
As a ^ w, aw > 0, so again we have zW > xy. 

Conversely, suppose xy < 'zw. So 'zw > 0, hence z ^ w. Construct line L 
through z and w. In case x = y, then z itself will be our a. In case x ^ y, 
apply Proposition 1.2 to get a b such that xy = zb. Draw circle (3 through 
b centered at z. As z is inside P and on L, we know that /3 and line L 
intersect. Since zb = xy < 'zw, we know that w lies outside /3. Thus we 
may take the intersection point a of /3 and L such that between(z, a, w) 
(by the fourth intersection construction rule). This is the a we need. 

• (xy ft 'zw). Similar to the previous. 

□ 

Lemma 5.8. // p(7r(r =^ 3x. A)) is provable in E , then so is T ^ 3x. A. 

Proof. Let T and A be the sets of formulas described at the beginning of Sec- 
tion [5?3l Using our abuses of notation, our supposition is that E proves 

p(^(r))^3z.p(7f(A)). 

Repeated application of clause (1) of Lemma [STTl shows that E proves 

T,t^3u. p(^(r)), 

where u are the new variables picked up in the translation. Using theorem 
application, E proves 

r,f ^ 3z,u. p(7f(A)). 
The last part of Lemma 15.71 shows that E proves 

r,f^3z,t?,«. A,p(^(A)), 

where v are the line and circle variables among x, lost in the translation back 
and forth, and now restored. Clause (2) of Lemma l5.7l then shows that E proves 

r,f =^ 3z,u, V. A, A. 
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Since the all the variables x are among z, u, v, the sequent 

r, f ^ 3x. A 

is subsumed by the previous one. Since E can also prove F => 3c .F for the new 
point variables that occur in F, it can prove 

F => 3x. A, 

as required. □ 

Putting everything together, we have the proof of the completeness theorem. 

Proof of Theorem 15. Jl Suppose that F => 3x. A is valid for ruler-and-compass 
constructions. By Lemma lSTSl 7r(F ^ 3x. A) is a valid sequent in the language of 
T. By Lemma [5^ there is a cut-free proof of that sequent in T. By Lemma 
jo(7r(F ^ 3x. A)) is provable in E. By Lemma \5M F 3x. A is provable in E, 
as required. □ 



6 Implementation 

In Sectioning we argued that the set of one-step inferences in E is decidable, 
as one would expect from any formal system. But given the fact that we are 
trying to model the inferential structure of the Elements, there is the implicit 
claim that verifying such inferences is within our cognitive capabilities, at least 
at the scale of complexity found in the proofs in the Elements. "Cognitively 
feasible" does not always line up with "computationally feasible," and it is 
often quite challenging to get computers to emulate common visual tasks. But, 
of course, our case would be strengthened if we could show that our inferences 
are computationally feasible as well. 

In fact, our analysis should make it possible to design a computational proof 
checker based on E that takes, as input, proofs that look like the ones in the 
Elements, and verifies their correctness against the rules of the system. In this 
section, we describe some preliminary studies that suggest that general purpose 
tools in automated reasoning are sufficient for the taskF^ 

In Section 13.81 we noted that any fact obtained by a direct diagram infer- 
ence is contained in the set of first-order consequences of the set of our universal 
axioms and the set of literals constituting the diagram. Furthermore, there are 
no function symbols in the language. These types of problems are fairly easy 
for off-the-shelf theorem provers for first-order logic. We entered our between- 
ness, same-side, and Pasch axioms in the standard TPTP format ("Thousands 

^*As part of his MS thesis work at Carnegie Mellon, Benjamin Northrop has written code in 
Java that carries out diagrammatic inferences using an eager saturation method: whenever a 
new object is added to the diagram, the system closes the diagram under rules and derives all 
the atomic and negation atomic consequences. The system works on small examples, but gets 
bogged down with diagrams of moderate complexity. But this does not rule out the fact that 
more sophisticated representations of the diagrammatic data might render such an approach 
viable. See the discussion later in this section. 
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of Problems for Theorem Provers,"), described a simple diagram with five lines 
and six points, and checked a number of consequences with the systems E [51] 
(no relation to our "E" ) and Spass [53] • The consequences were verified instan- 
taneously. 

There is also a class of systems called "satisfiability modulo theories" solvers, 
or SMT solvers for short, which combine decision procedures for provability of 
universal sentences modulo the combination of disjoint theories whose universal 
fragments are decidable Such systems typically include very fast decision 
procedures for linear arithmetic (that is, the linear theory of the reals). This 
is particularly helpful to us, since our metric inferences are of this sort. Unfor- 
tunately, SMT solvers do not provide complete decision procedures for the set 
of consequences of arbitrary universal axioms, which is what is needed to verify 
our diagrammatic and transfer inferences. Nonetheless, some solvers, like Z3 
[13] and CVC3 [2] provide heuristic instantiation of quantifiers. The advantage 
to using such systems is that they can handle not just the diagrammatic infer- 
ences, but the metric and transfer inferences as well. We entered all our axioms 
in the standard SMT format, and tested it with the two systems just mentioned. 
The results were promising; most inferences were instantaneous, and only a few 
required more than a few seconds. The diagram, axioms, and test queries can 
be found online, at Avigad's home page. 

The fact that SMT solvers can handle arbitrary quantifier-free logic, and the 
fact that one can incrementally add and retract statements from the database 
of asserted facts, suggests that SMT solvers can provide a complete back end 
to a proof checker for E. The proof checker then need only parse an input 
proof, assert the relevant facts to the SMT solver, and check the claimed conse- 
quences. More specifically, when the user asserts a theorem, the proof checker 
should declare the new objects (points, lines, and circles) to the SMT solver, 
assert the assumptions to the SMT solver, and store the conclusion. When the 
user enters a construction rule, the proof checker should check that the prereq- 
uisites are consequences of the facts already asserted to the SMT solver, create 
the new objects, and assert their properties. Applying a previously proved the- 
orem is handled in a similar way. When a user enters "hence the proof 
checker should check that A is a consequence of the facts already asserted to 
the SMT solver, and, if so, assert it explicitly to the SMT database, to facil- 
itate subsequent inferences. To handle suppositional reasoning (that is, proof 
by contradiction, or a branch of a case split), the proof checker should "push" 
the state of the SMT database and temporarily assert the local hypothesis, and 
then, once the desired conclusion is verified, "pop" the state and assert the 
resulting conditional. Finally, when the user enters "Q.E.D." or "Q.E.F.", the 
proof checker need only check that the negation of the theorem's conclusion is 
inconsistent with the facts that have been asserted to the SMT solver. 

Finally, we note that there has been recent work unifying resolution and 
SMT frameworks, for example, with the Spass-|-T system [35]. Such a system 
should be well-suited to verifying the inferences of E. 

Our explorations are only preliminary, and more experimentation is needed 
to support the claim that ordinary Euclidean inferences can be checked effi- 
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ciently. Moreover, performance can be sensitive to the choice of language and 
the formulation of the axioms. For example, we were surprised to find that per- 
formance was reduced when we replaced our strict "between" predicate with a 
nonstrict one (presumably because many additional facts, like between(a, a, 6), 
were generated). Thus the data which we report is only suggestive. 

We emphasize that the point of these explorations is to show that it should 
be possible to verify, automatically, proof texts which closely approximate the 
proofs in the Elements. From the point of fully automated geometric reasoning, 
our methods are fairly simplistic. There are currently at least four approaches 
to proving geometric theorems automatically. The first is to translate the theo- 
rem to the language of real closed fields and use decision procedures, based on 
cylindrical algebraic decomposition [10], for the latter; but, in practice, this is 
too slow even for very simple geometric theorems. A second method, known 
as Wu's method [65], similarly translates geometric statements into algebraic 
problems and uses computational algebraic techniques. The method is stun- 
ningly successful at verifying many difficult geometric theorems, but it cannot 
handle the order relation between magnitudes, or the "between" predicate for 
points on a line; and so it is inadequate for much of the Elements. It is also 
limited to statements that can be translated to universal formulas in the lan- 
guage of fields. A third method, known as the area method [S], has similar 
features. Finally, there are so-called "synthetic methods," which use heuristic 
proof search from geometric axioms. Our methods fall under this heading, but 
are not very advanced. One would expect to do better with intelligent heuristics 
and more efficient representations of diagrammatic information, along the lines 
described by Chou, Gao, and Zhang [9]. (See also [8] for an overview of the 
various methods.) 

In other words, our work does not constitute a great advance in automated 
geometric theorem proving, even for the kinds of theorems one find in the Ele- 
ments. Our methods show how to verify the smaller, diagrammatic inferences 
in Euclid's proofs, given the higher-level structure, and, most importantly, the 
requisite construction. It is an entirely different question as to how a system 
might be able to find such a construction automatically. We have not addressed 
this question at all. 

We do hope, however, that our analysis of the way that Euclidean reasoning 
combines metric and diagrammatic components can provide some useful insights 
towards modeling proof search in structured domains. Rather than model ge- 
ometry as a first-order axiomatic system, we have taken advantage of specific 
features of the domain that reduce the search space dramatically. Particularly 
notable is the way that we understand Euclidean proofs as building up contexts 
of data (in our case, "diagrammatic information" and "metric information") 
that can be handled in domain-specific ways. In other words, adding objects 
"to the diagram" and inferring metric consequences means adding information 
to a database of local knowledge that will be accessed and used in very partic- 
ular ways. We expect that such approaches will be fruitful in modeling other 
types of mathematical reasoning as well. 



73 



7 Conclusions 



We conclude by summarizing what we take our analysis of Euclidean proof to 
have accomplished, discussing questions and other work related to our project, 
and indicating some of the questions and broader issues that our work does not 
purport to address. 

7.1 Summary of results 

We claim to have a clean analysis of the argumentative structure of the proofs 
in Books I to IV of the Elements. We tried to make this claim more precise 
in Section [2] by discussing the features of the Elements that we have tried to 
model. We have also gone out of our way, in Section 01 to indicate ways in 
which proofs in our formal system differ from Euclid's. 

It is important to keep in mind that modeling the "argumentative struc- 
ture" of the Elements is not just a matter of modeling the Euclidean entailment 
relation in semantic or deductive terms, or giving an account of geometric va- 
lidity. Rather, our goal has been to understand which individual inferences are 
licensed by Euclidean practice, so that a line-by-line comparison renders our 
formal proofs close to Euclid's. To the extent in which we have succeeded, this 
provides a sense in which the proofs in the Elements are more rigorous than 
is usually claimed. In particular, we have identified precise rules that govern 
diagrammatic inferences, which are sound relative to modern semantics; and 
we have shown that, for the most part, Euclid's proofs obey these rules. As a 
result, the proofs in the Elements now seem to us to be much closer to formal 
proof texts than almost any other instance of informal mathematics. 

In Section [51 we showed that our formal system is sound and complete for 
an appropriate semantics of ruler and compass constructions. Insofar as our for- 
mal system captures Euclidean practice, this shows that the modern semantics 
provides an accurate characterization of the provable Euclidean theorems. 

In Section [S] we described some initial but promising attempts to verify the 
inferences of E using current automated reasoning technology. Our findings 
suggest that it should not be difficult to develop a formal proof checker for 
E. This provides further support to our claim that proofs in the Elements are 
much closer to formal proofs than is usually acknowledged. The way proofs in 
E organize data into metric and diagrammatic components, each of which is 
individually more manageable than their union, hints at a strategy that should 
have broader application to formal verification. 

Finally, we emphasize that we have provided a logical analysis, which screens 
off cognitive, historical, and broader philosophical questions related to diagram 
use. This is not to deny the importance of such questions. On the contrary, 
we feel that by fixing ideas and clarifying basic notions, the logical analysis can 
support the study of diagram use and Euclidean practice. Thus we take our 
analysis to show how the norms of a mathematical practice can be analyzed on 
their own terms, in a way that can support broader inquiry. We hope that we 
have also demonstrated that such analysis can be rewarding, providing us with 
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a better understanding of the mathematics itself. 
7.2 Questions and related work 

Our work is situated in a long tradition of axiomatic studies of geometry, from 
Hilbert to Tarski and through to the present day. Our emphasis is novel, in 
that we have tried to characterize a particular geometric practice and style of 
argumentation. In contrast, modern axiomatic studies aim to provide a deeper 
understanding of geometry in modern terms, focusing, for example, on the de- 
pendence and independence of axioms and theorems, the results of dropping 
or modifying various axioms, and the relationships to other axiomatic systems. 
We cannot provide an adequate survey of these topics here, but recommend 
textbooks by Coxeter [TT] and Hartshorne [21]. (See also the article by Tarski 
and Givant [58j , which surveys the history of geometric studies by Tarski and 
his students.) 

Our project does raise some traditional logical questions, however. For ex- 
ample, our diagrammatic axioms are all universal axioms, and describe a subset 
of the universal consequences of Tarski's axioms for Euclid's geometry. It would 
be nice to have a natural semantic characterization of this set of universal sen- 
tences. We know that it is a strict subset of the set of universal consequences 
of affine geometry: Hilbert [22l Chapter V] showed that Desargues' theorem, 
which is a consequence of affine geometry, cannot be proved in the plane without 
the axioms of congruence. Also, given that our construction rules are not inde- 
pendent, it would be nice to have a more principled way of generating the list, 
beyond simply running through the Elements and making a list of the ones that 
Euclid seems to use. Finally, as we have mentioned, the question as to the de- 
cidability of the V3 consequences of Tarski's axioms, and hence the decidability 
of E, remain open. 

Read as first-order axioms, all the basic rules of E are given by universal 
formulas, except for the construction rules, which have V3 form. If we introduce 
Skolem functions for these axioms, Herbrand's theorem implies that any theorem 
of E can be witnessed by an explicit construction involving these functions, 
together with "if . . . then . . . else" statements involving atomic conditions. This 
provides one sense in which Euclidean geometry is "constructive." However, 
conditional expressions are undesirable; from a constructive perspective, for 
example, it may be impossible to determine whether a point is actually on a 
line or only very close to it. Jan von Plato [61j provides a strictly constructive 
version of afhne geometry (see also [62|). Michael Beeson f3| characterizes the 
problem nicely by observing that Euclid's constructions are not continuous in 
the input data, and offers a constructive version of Euclidean geometry. 

Our project also gives rise to computational questions. On the theoretical 
side, there is, of course, the problem of providing sharp upper and lower bounds 
on the complexity of recognizing the various types of inference that, accord- 
ing to E, Euclid sanctions as immediate. The challenge of obtaining practical 
implementations should give rise to interesting problems and solutions as well. 

The implementation of a proof-checker for E could be used to help teach 
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Euclidean geometry, and Euclidean methods of proof. There are a number 
of graphical software packages in existence that support geometric exploration 
and reasoning, of which the best known are perhaps the Geometer's Sketchpad 
pS] . Cahri [53], and Cinderella [Hj. These systems do not, however, focus on 
teaching geometric proof. Others have explored the use of graphical front ends 
to conventional proof assistants, supported by specialized decision procedures 
for geometry. As we were completing a draft of this paper, we came across 
Narboux [U] . which not only provides a thorough survey of such work, but 
also describes an impressive effort, Geoproof, along these lines. Even though 
Geoproof is not based on an explicit analysis of Euclidean proof, it is interesting 
to note that its primitives and construction rules bear a striking similarity to 
ours. 

7.3 Broader issues 

In the end, what is perhaps least satisfying about our analysis is that we do 
not go beyond the logical and computational issues: we provide a detailed de- 
scription of the norms governing Euclidean proof without saying anything at all 
about how those norms arose, or why they should be followed. We will therefore 
close with just a few words about some of the cognitive, historical, and more 
broadly philosophical issues that surround our work. 

On the surface, it might seem that there is a straightforward cognitive expla- 
nation as to why some of Euclid's diagrammatic inferences are basic to geometric 
practice, namely, that these inferences rely on spatial properties that are "hard- 
wired" into our basic perceptual faculties. In other words, thanks to evolution, 
we have very good faculties for picking out edges and surfaces in our environ- 
ment and inferring spatial relationships; and these are the kinds of abilities 
that are needed to support diagrammatic inference. But one should be wary of 
overly simplistic explanations of this sort; see the discussion in Ij. In particu- 
lar, one should keep in mind that mature mathematical behavior is only loosely 
related to more basic perceptual tasks. For instance, the example discussed in 
Section [2.31 shows that Euclidean geometric reasoning requires keeping in mind 
that only some features present in a diagram are essential to the mathematical 
context it is supposed to illustrate. Informal experimentation on some of our 
nonmathematical friends and family members shows that the expected response 
to this exercise is by no means intuitively clear; in other words, there seems to 
be a learned mathematical component to the normative behavior. At the same 
time, we do not doubt that a better understanding of our cognitive abilities can 
help explain why certain geometric inferences are easier than others. It would 
therefore be nice to have a better understanding of the cognitive mechanisms 
that are involved in such reasoning. 

We hope that our analysis can support a refined historical understanding as 
well. Historians will cringe at our naive claim to have analyzed "the text of the 
Elements" ; there is a long and complicated history behind the Elements, and 
we have focused our attention on only one translation (Heath's) of one version 
of the text (Heiberg's). We do expect that, for the most part, our findings are 
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robust across the various editions. In fact, some features of the historical record 
nicely support our claims. Saito [50] has compared the diagrams in a number 
of editions of the Elements, and has noted that earlier versions exhibit some 
striking differences from the modern ones. For example, earlier diagrams are 
often "overspecified" : a parallelogram mentioned in the statement of a theorem 
may be depicted by a rectangle, or even a square. This sits well with our claim 
that angle and metric information is never inferred from the diagram; the fact 
that the metric information in the diagrams is so blatantly misleading can be 
viewed as a subtle reminder to the reader that it should not be relied uponF^ 
On the other hand, if it turns out that there are ways in which our analysis does 
not hold up well across historical developments, we expect that our work can 
help clarify the nature of the historical changes. 

Moreover, we hope our analysis can help support a better historical under- 
standing of the evolution of geometric reasoning, and the relationship between 
different geometric practices. There have been rich historical analyses of the 
problems and methods found in the ancient geometric tradition [261 144] , as well 
as, say, the transition to the analytic tradition of Descartes |^ . Ken Manders 
has remarked to us that diagrams are used in fundamentally different ways in 
nineteenth century projective geometry texts; as the diagrams get more com- 
plicated, more of the burden of keeping track of the information they represent 
is shifted to the text. We expect that the type of analysis we carry out here 
can complement the historical study, and sharpen our understanding of the 
mathematical developments. 

Finally, there is hope that the rules of Euclidean proof can be "explained" or 
"justified" not by cognitive or historical data, but, rather, by broader epistemo- 
logical considerations. For example, Marco Panza [45] takes Euclidean practice 
to inform a metaphysical account of the nature of geometric objects; Marcus 
Giaquinto [19j takes cognitive data to support epistemological conclusions re- 
garding the role of visualization in mathematics (but see the critique in jlj ) ; and 
Jamie Tappenden [5S] explores ways of treating visualization as an "objective" 
feature of mathematics, rather than merely a cognitive device. It is possible 
that a suitably abstract characterization of our cognitive abilities or the spatial 
situations the practice tries to model can provide an informative sense in which 
our fundamental inferences are the "right" ones for the task. 

Kant famously took the fundamental principles of geometry to provide syn- 
thetic knowledge, grounded by our a priori intuition of space: 

Take the proposition that with two straight lines no space at all can 
be enclosed, thus no figure is possible, and try to derive it from the 
concept of straight lines and the number two; or take the proposition 
that a figure is possible with three straight lines, and in the same way 
try to derive it from these concepts. All of your effort is in vain, and 
you see yourself forced to take refuge in intuition, as indeed geometry 
always does. You thus give yourself an object in intuition; but what 
kind is this, is it a pure a priori intuition or an empirical one? 

^^We are grateful to Anthony Jones and Karine Chemla for this observation. 
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If it were the latter, then no universahy vaUd, let alone apodictic 
proposition could ever come from it: for experience can never provide 
anything of this sort. You must therefore give your object a priori 
in intuition, and ground your synthetic proposition on this. [241 
A47-A48/B64-B65]. 

Indeed, his discussion of Euclid's Proposition 1.32 in the Transcendental Doc- 
trine of Method [24, A712-A725/B740-753] provides an illuminating account of 
how he takes such synthetic reasoning to work. Kant's views on geometry have 
been studied in depth; see, for example, [T71 [5H [531 [SI] . Lisa Shabel writes: 

[The] Kantian account of informal but contentful axioms of Eu- 
clidean geometry stemming directly from an a priori representation 
of space is itself consistent with Euclidean practice: neither Euclid's 
elements nor its eighteenth-century analogs offer formal axioms but 
rather definitions and postulates which, if taken seriously, provide a 
mereotopological description of the relations among the parts of the 
euclidean plane. The content of these relations is . . . precisely what 
Kant alleges is accessible to us in pure intuition, prior to geometric 
demonstration. [Ml p. 213] 

This provides us with a convenient way of framing our project: we have pro- 
vided a logical description of the mereotopological relations that are implicit 
in Euclid's definitions and postulates, without feigning hypotheses as to their 
origins. As Shabel's remarks suggest (see also [Ml footnote 4] and [52]), it would 
be interesting if one could describe a more fundamental account of spatial in- 
tuition that can serve to justify or explain the rules of our system. Stewart 
Shapiro has suggested to us that it would also be interesting to explain what 
distinguishes Euclid's axioms and postulates from everything he does not say, 
that is, the assumptions and rules of inference that we take to be implicit in the 
Elements. 

In Section [1] we noted that philosophers have historically been concerned 
with the problem of how the particular diagrams in the Elements can warrant 
general conclusions. In particular, a central goal of Kant's account [Ml A712- 
A725/B740-753] is to explain how singular objects given in intuition can provide 
general knowledge. Jeremy Heis has pointed out to us that a curious feature 
of our account of Euclidean geometry is that the role of the singular — that 
is, the particular diagram — drops out of the story entirely; we focus only on 
the diagrammatic features that are generally valid in a given context, and say 
nothing about a particular instantiation. 

There is a fairly mundane, if partial, explanation of the role that concrete 
diagrams play in geometric practice. Although not every feature found in a 
particular diagram will be generally valid, the converse is more or less true: any 
generally valid consequence of the diagrammatic hypotheses will be present in a 
sufficiently well-drawn diagram. A particular diagram can therefore serve as a 
heuristic guide, suggesting candidates for diagrammatic consequences that are, 
perhaps, confirmed by other forms of reasoning. Mumma's original system, Eu, 
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is more faithful to this understanding of diagram use; for example, the prover 
can label a point of intersection in a particular diagram associated with a proof, 
independent of the mechanisms that are invoked to justify the fact that the 
intersection is present in general. Some systems of automated reasoning rely 
on crude procedures to search for possible proof candidates, and then employ 
other methods to check and fill in the details (see, for example, [Ml [Snj)- It 
therefore seems to us worth noting that diagram use in mathematics raises two 
separate issues: first, how (or whether) alternative, nonpropositional represen- 
tations of mathematical data can be used to facilitate or justify inferences; and, 
second, how overspecific or imperfect representations can be used to support 
the reasoning process. Leitgeb [IS] begins to address the first issue. 

As the vast literature on the Elements indicates, Euclidean geometry has 
been a lively source of questions for scholars of all persuasions for more than 
two millennia. We only hope that the understanding of Euclidean proof we 
present here will prove useful in furthering such inquiry. 
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